dovecot-1.0: From-line checking wrote to bad memory location in ...

[dovecot at dovecot.org]

details:   http://hg.dovecot.org/dovecot-1.0/rev/f057b11c0e9e
changeset: 5440:f057b11c0e9e
user:      Timo Sirainen <tss at iki.fi>
date:      Mon Oct 29 12:43:16 2007 +0200
description:
From-line checking wrote to bad memory location in stack.

diffstat:

1 file changed, 11 insertions(+), 4 deletions(-)
src/deliver/deliver.c |   15 +++++++++++----

diffs (62 lines):

diff -r a69af46e0926 -r f057b11c0e9e src/deliver/deliver.c
--- a/src/deliver/deliver.c	Sun Oct 28 03:12:17 2007 +0300
+++ b/src/deliver/deliver.c	Mon Oct 29 12:43:16 2007 +0200
@@ -424,17 +424,22 @@ static void save_header_callback(struct 
 	}
 }
 
-static struct istream *create_mbox_stream(int fd, const char *envelope_sender)
+static struct istream *
+create_mbox_stream(int fd, const char *envelope_sender, bool **first_r)
 {
 	const char *mbox_hdr;
 	struct istream *input_list[4], *input, *input_filter;
-	bool first = TRUE;
 
 	fd_set_nonblock(fd, FALSE);
 
 	envelope_sender = address_sanitize(envelope_sender);
 	mbox_hdr = mbox_from_create(envelope_sender, ioloop_time);
 
+	/* kind of kludgy to allocate memory just for this, but since this
+	   has to live as long as the input stream itself, this is the safest
+	   way to do it without it breaking accidentally. */
+	*first_r = i_new(bool, 1);
+	**first_r = TRUE;
 	input = i_stream_create_file(fd, default_pool, 4096, FALSE);
 	input_filter = i_stream_create_header_filter(input,
 						     HEADER_FILTER_EXCLUDE |
@@ -442,7 +447,7 @@ static struct istream *create_mbox_strea
 						     mbox_hide_headers,
 						     mbox_hide_headers_count,
 						     save_header_callback,
-						     &first);
+						     *first_r);
 	i_stream_unref(&input);
 
 	input_list[0] = i_stream_create_from_data(default_pool, mbox_hdr,
@@ -581,6 +586,7 @@ int main(int argc, char *argv[])
 	struct mail *mail;
 	uid_t process_euid;
 	bool stderr_rejection = FALSE;
+	bool *input_first;
 	int i, ret;
 
 	i_set_failure_exit_callback(failure_exit_callback);
@@ -767,7 +773,7 @@ int main(int argc, char *argv[])
 
 	mbox_storage = mail_storage_create("mbox", "/tmp", destination, 0,
 					   MAIL_STORAGE_LOCK_FCNTL);
-	input = create_mbox_stream(0, envelope_sender);
+	input = create_mbox_stream(0, envelope_sender, &input_first);
 	box = mailbox_open(mbox_storage, "Dovecot Delivery Mail", input,
 			   MAILBOX_OPEN_NO_INDEX_FILES |
 			   MAILBOX_OPEN_MBOX_ONE_MSG_ONLY);
@@ -839,6 +845,7 @@ int main(int argc, char *argv[])
 		/* ok, rejection sent */
 	}
 	i_stream_unref(&input);
+	i_free(input_first);
 
 	mail_free(&mail);
 	mailbox_transaction_rollback(&t);