From 5e9a857791a36ee243aa879de5777ed8066c6507 Mon Sep 17 00:00:00 2001 From: Aki Tuomi Date: Mon, 17 Aug 2026 11:13:18 +0300 Subject: [PATCH] [PATCH 05/12] lib-index: mail-index-strmap - Fix OOB read from truncated record size Gbp-Pq: Name 0005-lib-index-mail-index-strmap-Fix-OOB-read-from-trunca.patch --- src/lib-index/mail-index-strmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/lib-index/mail-index-strmap.c b/src/lib-index/mail-index-strmap.c index fb92517..9ce2de9 100644 --- a/src/lib-index/mail-index-strmap.c +++ b/src/lib-index/mail-index-strmap.c @@ -425,6 +425,9 @@ mail_index_strmap_read_rec_first(struct mail_index_strmap_read_context *ctx, if (mail_index_strmap_read_packed(ctx, &n) <= 0) return -1; count = n < 2 ? n + 1 : n; + /* check that rec_size fits */ + if (UINT_MAX / (sizeof(ctx->rec.str_idx) + sizeof(*crc32_r)) < count) + return -1; ctx->view->total_ref_count += count; ctx->rec_size = count * (sizeof(ctx->rec.str_idx) + sizeof(*crc32_r)); -- 2.39.5