[PATCH 2/3] lib-storage: thread - Limit References: header msgid count to prevent...

Cap per-message References ingestion at MAIL_THREAD_REFERENCES_MAX (1000)
in mail_thread_map_add_mail(). Without this limit a single crafted email
with N unique Message-IDs triggers N(N-1)/2 ancestor traversals in
thread_node_has_ancestor(), allowing unauthenticated DoS via mail delivery.

Gbp-Pq: Name 0002-lib-storage-thread-Limit-References-header-msgid-cou.patch

diff --git a/src/lib-storage/index/index-thread-private.h b/src/lib-storage/index/index-thread-private.h
index ed2837b7bb4c34cdfebe6d50950df18842aa844f..563c3a3d2d18522022a58838a9dcff861f9ff976 100644 (file)
--- a/src/lib-storage/index/index-thread-private.h
+++ b/src/lib-storage/index/index-thread-private.h
@@ -22,6 +22,10 @@
 #define MAIL_THREAD_NODE_REF_MSGID 0
 #define MAIL_THREAD_NODE_REF_INREPLYTO 1
 #define MAIL_THREAD_NODE_REF_REFERENCES1 2
+/* Maximum number of References: header message-IDs stored per message.
+   Prevents O(N²) CPU usage in thread_node_has_ancestor() when a single
+   crafted message contains an abnormally long reference chain. */
+#define MAIL_THREAD_REFERENCES_MAX 1000
 
 struct mail_thread_node {
        /* UID of the message, or 0 for dummy nodes */

diff --git a/src/lib-storage/index/index-thread.c b/src/lib-storage/index/index-thread.c
index e20a97072cabb677b2ce6f5516606c246ff9b67c..a58f9681f354d434ee2a0d296bb3ad8b1fed5d97 100644 (file)
--- a/src/lib-storage/index/index-thread.c
+++ b/src/lib-storage/index/index-thread.c
@@ -280,7 +280,8 @@ mail_thread_map_add_mail(struct mail_thread_context *ctx, struct mail *mail)
                                                ref_index, msgid);
                                }
                        } T_END;
-               } while (msgid != NULL);
+               } while (msgid != NULL &&
+                        ref_index < MAIL_THREAD_NODE_REF_REFERENCES1 + MAIL_THREAD_REFERENCES_MAX);
        } else {
                /* no References:, use In-Reply-To: */
                if (thread_get_mail_header(mail, HDR_IN_REPLY_TO,