dovecot: If extension record was tried to be updated for uid=0, ...

[dovecot at dovecot.org]

details:   http://hg.dovecot.org/dovecot/rev/b7fc50c68c35
changeset: 7163:b7fc50c68c35
user:      Timo Sirainen <tss at iki.fi>
date:      Tue Jan 15 18:16:06 2008 +0200
description:
If extension record was tried to be updated for uid=0, log an error instead
of crashing. Also log error if uid >= next_uid.

diffstat:

1 file changed, 6 insertions(+)
src/lib-index/mail-index-sync-ext.c |    6 ++++++

diffs (16 lines):

diff -r 1bcb1bae8bed -r b7fc50c68c35 src/lib-index/mail-index-sync-ext.c
--- a/src/lib-index/mail-index-sync-ext.c	Mon Jan 14 07:17:28 2008 +0200
+++ b/src/lib-index/mail-index-sync-ext.c	Tue Jan 15 18:16:06 2008 +0200
@@ -557,6 +557,12 @@ mail_index_sync_ext_rec_update(struct ma
 	i_assert(ctx->cur_ext_map_idx != (uint32_t)-1);
 	i_assert(!ctx->cur_ext_ignore);
 
+	if (u->uid == 0 || u->uid >= view->map->hdr.next_uid) {
+		mail_index_sync_set_corrupted(ctx,
+			"Extension record update for invalid uid=%u", u->uid);
+		return -1;
+	}
+
 	if (!mail_index_lookup_seq(view, u->uid, &seq))
 		return 1;