search for: stack_block

...2 deletions(-) diff --git a/usr/dash/memalloc.c b/usr/dash/memalloc.c index e75e609..406d0c8 100644 --- a/usr/dash/memalloc.c +++ b/usr/dash/memalloc.c @@ -213,13 +213,11 @@ growstackblock(void) newlen += 128; if (stacknxt == stackp->space && stackp != &stackbase) { - struct stack_block *oldstackp; struct stack_block *sp; struct stack_block *prevstackp; size_t grosslen; INTOFF; - oldstackp = stackp; sp = stackp; prevstackp = sp->prev; grosslen = newlen + sizeof(struct stack_block) - MINSIZE; -- 1.7.3.1

...18 @@ growstackblock(void) { size_t newlen; - newlen = stacknleft * 2; + newlen = stacknleft * 2; if (newlen < stacknleft) sh_error("Out of space"); if (newlen < 128) newlen += 128; if (stacknxt == stackp->space && stackp != &stackbase) { - struct stack_block *oldstackp; struct stack_block *sp; struct stack_block *prevstackp; size_t grosslen; INTOFF; - oldstackp = stackp; sp = stackp; prevstackp = sp->prev; grosslen = newlen + sizeof(struct stack_block) - MINSIZE;

I have a message with over a 1000 embedded attachments(!), and it breaks Dovecot. The issue appears to be buffer management. There is some logic in the function message_part_deserialize_part that seems to assume that the message part structure is in a contiguous array, but that doesn't seem to be the case. I haven't been able to figure out enough about the memory management in Dovecot to

...; newlen = stacknleft * 2; if (newlen < stacknleft) sh_error("Out of space"); - if (newlen < 128) - newlen += 128; + min = SHELL_ALIGN(min | 128); + if (newlen < min) + newlen += min; if (stacknxt == stackp->space && stackp != &stackbase) { struct stack_block *sp; @@ -261,15 +261,15 @@ void * growstackstr(void) { size_t len = stackblocksize(); - growstackblock(); + + growstackblock(0); return stackblock() + len; } char *growstackto(size_t len) { - while (stackblocksize() < len) - growstackblock(); - + if (stackblocksize() < len) + gro...