From 2c9922047eb2831310f0f893039d62db924ed9c9 Mon Sep 17 00:00:00 2001
From: Ken Hornstein <kenh@pobox.com>
Date: Tue, 7 Jan 2014 11:45:24 -0500
Subject: [PATCH] Prevent message status allocation code from overflowing if we
 get a message number that is too high; simply abort instead.

---
 sbr/folder_read.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/sbr/folder_read.c b/sbr/folder_read.c
index 4a9f7fba..5c52abde 100644
--- a/sbr/folder_read.c
+++ b/sbr/folder_read.c
@@ -124,6 +124,16 @@ folder_read (char *name, int lockflag)
     /* for testing, allocate minimal necessary space */
     /* mp->hghoff = max (mp->hghmsg, 1); */
 
+    /*
+     * If for some reason hghoff < lowoff (like we got an integer overflow)
+     * the complain about this now.
+     */
+
+    if (mp->hghoff < mp->lowoff) {
+	adios(NULL, "Internal failure: high message limit < low message "
+	      "limit; possible overflow?");
+    }
+
     /*
      * Allocate space for status of each message.
      */
-- 
2.56.0