dovecot - Oct 2008 - Embedded "From<space>" Lines

Hi.

As some of you may remember, I reported a problem a while back where  
dovecot 1.1.beta14 (as well as dovecot 1.0) would corrupt mbox-style  
mailboxes by ignoring the Content-Length header and breaking up  
messages with embededed "From<space>" lines.

I recently downloaded Dovecot 1.1.5 and noted to my pleasure that this  
bug now has been fixed.  That's great!  This fix envolves checking to  
see if the expected_body_size (from the Content-Length header) is  
larger than the body_size produced by the "From<space>" scanner,
and
if so, if there is a valid "From<space>" line at the
"expected" end of
the message.

However, I also noted that there's a case which the fix doesn't cover,  
and that's where the "From<space>" line appears as the first
line of
the body of the message.  When this happens, the body_offset will  
point to the blank line between the headers and the body and not the  
actual first line of the body.  This will cause the stream to be  
mispositioned at the time of the "From<space>" verification
check in
istream_raw_mbox_get_body_size and the (actually correct)  
expected_body_size will be rejected.

I have enclosed a simple diff that will work around this by adjusting  
the body_offset to point to the next line at the time of call to  
istream_raw_mbox_is_valid_from in istream_raw_mbox_get_body_size.   
This appears to handle the problem correctly in all the test cases I  
have.

To anyone else who has run into this problem and gotten corrupted  
mailboxes as a result, I can also offer an mbox checker that will  
attempt to detect and repair this problem in existing mailboxes as  
well as inspect them for other problems.  I'm not ready to send it out  
for a full release yet, but interested beta testers are invited to  
contact me directly.

Cheers,
--Lennart

-------------- next part --------------
A non-text attachment was scrubbed...
Name: istream-raw-mbox.c.diff
Type: application/octet-stream
Size: 1349 bytes
Desc: not available
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20081027/68a2b5a5/attachment-0002.obj>
-------------- next part --------------

On Mon, 2008-10-27 at 14:29 -0700, Lennart L?vstrand
wrote:
> However, I also noted that there's a case which the fix doesn't
cover,
> and that's where the "From<space>" line appears as the
first line of
> the body of the message.  When this happens, the body_offset will  
> point to the blank line between the headers and the body and not the  
> actual first line of the body.  This will cause the stream to be  
> mispositioned at the time of the "From<space>" verification
check in
> istream_raw_mbox_get_body_size and the (actually correct)  
> expected_body_size will be rejected.
> 
> I have enclosed a simple diff that will work around this by adjusting  
> the body_offset to point to the next line at the time of call to  
> istream_raw_mbox_is_valid_from in istream_raw_mbox_get_body_size.   
> This appears to handle the problem correctly in all the test cases I  
> have.
Thanks. I fixed it basically the same way but with a bit different code:
http://hg.dovecot.org/dovecot-1.1/rev/9c3fa81a721d

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20081029/fc5e5581/attachment-0002.bin>