Mercurial > dovecot > core-2.2

changeset 12747:9a4c198597d8

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
lib-index: Verify that expunge-guid records have valid UID.
author Timo Sirainen <tss@iki.fi>
date Tue, 22 Feb 2011 10:21:26 +0200
parents cce208f9b393
children dc4e0320c087
files src/lib-index/mail-transaction-log-view.c
diffstat 1 files changed, 14 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/src/lib-index/mail-transaction-log-view.c	Fri Feb 18 05:56:38 2011 +0200
+++ b/src/lib-index/mail-transaction-log-view.c	Tue Feb 22 10:21:26 2011 +0200
@@ -495,13 +495,25 @@
 		array_create_from_buffer(&uids, &uid_buf,
 			sizeof(struct mail_transaction_expunge));
 		break;
-	case MAIL_TRANSACTION_EXPUNGE_GUID:
-		if ((rec_size % sizeof(struct mail_transaction_expunge_guid)) != 0) {
+	case MAIL_TRANSACTION_EXPUNGE_GUID: {
+		const struct mail_transaction_expunge_guid *recs = data;
+		unsigned int i, count;
+
+		if ((rec_size % sizeof(*recs)) != 0) {
 			mail_transaction_log_file_set_corrupted(file,
 				"Invalid expunge guid record size");
 			return FALSE;
 		}
+		count = rec_size / sizeof(*recs);
+		for (i = 0; i < count; i++) {
+			if (recs[i].uid == 0) {
+				mail_transaction_log_file_set_corrupted(file,
+					"Expunge guid record with uid=0");
+				return FALSE;
+			}
+		}
 		break;
+	}
 	case MAIL_TRANSACTION_FLAG_UPDATE:
 		buffer_create_const_data(&uid_buf, data, rec_size);
 		array_create_from_buffer(&uids, &uid_buf,