From: Aki Tuomi <aki.tuomi@open-xchange.com>
Date: Mon, 17 Aug 2026 08:13:18 +0000 (+0300)
Subject: [PATCH 05/12] lib-index: mail-index-strmap - Fix OOB read from truncated record size
X-Git-Tag: archive/raspbian/1%2.4.1+dfsg1-6+rpi1+deb13u7^2~36
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=5e9a857791a36ee243aa879de5777ed8066c6507;p=dovecot.git

[PATCH 05/12] lib-index: mail-index-strmap - Fix OOB read from truncated record size


Gbp-Pq: Name 0005-lib-index-mail-index-strmap-Fix-OOB-read-from-trunca.patch
---

diff --git a/src/lib-index/mail-index-strmap.c b/src/lib-index/mail-index-strmap.c
index fb92517..9ce2de9 100644
--- a/src/lib-index/mail-index-strmap.c
+++ b/src/lib-index/mail-index-strmap.c
@@ -425,6 +425,9 @@ mail_index_strmap_read_rec_first(struct mail_index_strmap_read_context *ctx,
 	if (mail_index_strmap_read_packed(ctx, &n) <= 0)
 		return -1;
 	count = n < 2 ? n + 1 : n;
+	/* check that rec_size fits */
+	if (UINT_MAX / (sizeof(ctx->rec.str_idx) + sizeof(*crc32_r)) < count)
+		return -1;
 	ctx->view->total_ref_count += count;
 
 	ctx->rec_size = count * (sizeof(ctx->rec.str_idx) + sizeof(*crc32_r));