[PATCH 05/12] lib-index: mail-index-strmap - Fix OOB read from truncated record size

Gbp-Pq: Name 0005-lib-index-mail-index-strmap-Fix-OOB-read-from-trunca.patch

diff --git a/src/lib-index/mail-index-strmap.c b/src/lib-index/mail-index-strmap.c
index fb925170682ecfcc444542906a62b9d2fd1b06f3..9ce2de9103fb0cbc409856c3b33749eff7e2e41a 100644 (file)
--- a/src/lib-index/mail-index-strmap.c
+++ b/src/lib-index/mail-index-strmap.c
@@ -425,6 +425,9 @@ mail_index_strmap_read_rec_first(struct mail_index_strmap_read_context *ctx,
        if (mail_index_strmap_read_packed(ctx, &n) <= 0)
                return -1;
        count = n < 2 ? n + 1 : n;
+       /* check that rec_size fits */
+       if (UINT_MAX / (sizeof(ctx->rec.str_idx) + sizeof(*crc32_r)) < count)
+               return -1;
        ctx->view->total_ref_count += count;
 
        ctx->rec_size = count * (sizeof(ctx->rec.str_idx) + sizeof(*crc32_r));