changeset 8862:2653007d906d HEAD

mail_index_map_modseq_clone() caused memory corruption.
author Timo Sirainen <tss@iki.fi>
date Wed, 25 Mar 2009 15:52:52 -0400
parents 9d00503821d6
children b61c15279b65
files src/lib-index/mail-index-modseq.c
diffstat 1 files changed, 16 insertions(+), 4 deletions(-) [+]
line wrap: on
line diff
--- a/src/lib-index/mail-index-modseq.c	Wed Mar 25 15:38:57 2009 -0400
+++ b/src/lib-index/mail-index-modseq.c	Wed Mar 25 15:52:52 2009 -0400
@@ -612,12 +612,24 @@
 mail_index_map_modseq_clone(const struct mail_index_map_modseq *mmap)
 {
 	struct mail_index_map_modseq *new_mmap;
+	const struct metadata_modseqs *src_metadata;
+	struct metadata_modseqs *dest_metadata;
+	unsigned int i, count;
+
+	src_metadata = array_get(&mmap->metadata_modseqs, &count);
 
 	new_mmap = i_new(struct mail_index_map_modseq, 1);
-	i_array_init(&new_mmap->metadata_modseqs,
-		     array_count(&mmap->metadata_modseqs) + 16);
-	array_append_array(&new_mmap->metadata_modseqs,
-			   &mmap->metadata_modseqs);
+	i_array_init(&new_mmap->metadata_modseqs, count + 16);
+
+	for (i = 0; i < count; i++) {
+		dest_metadata = array_append_space(&new_mmap->metadata_modseqs);
+		if (array_is_created(&src_metadata[i].modseqs)) {
+			i_array_init(&dest_metadata->modseqs,
+				     array_count(&src_metadata[i].modseqs));
+			array_append_array(&dest_metadata->modseqs,
+					   &src_metadata[i].modseqs);
+		}
+	}
 	return new_mmap;
 }