Tracked down a bug that was causing our users to exceed their quota
without any mail in their boxes.

Deleted mail with entries in the maildirsize showing as

"       -4804        -1"

are parsed incorrectly by the sscanf in maildirsize_read() in file
maildirquota.c at line 335:

sscanf(q, "%ld %d", &n, &c);

This ends up setting n to a large value (around 4294962492) which
makes the users' typical 25MB quota far over.

At the top of the function, n is declared as an int (line 285), and
midway through the function there is "long n=0;" at line 319 which
appears to have been intended to be used within the scope of the while

vpopmail 5.4.12 running on OpenBSD 3.8

--- maildirquota.c.orig Tue Jan 24 11:24:36 2006
+++ maildirquota.c      Tue Jan 24 11:24:58 2006
@@ -283,5 +283,5 @@
  char *p;
  unsigned l;
- int n;
+ long n;
  int first;

Jon Simola
Systems Administrator
ABC Communications

Reply via email to