Re: BUG: maildir flags sync with database relative path results in corrupted filename

diff --git a/78/14502f303ea87bcc46822f89ec2b15047ab091 b/78/14502f303ea87bcc46822f89ec2b15047ab091
new file mode 100644 (file)
index 0000000..e8fa924
--- /dev/null
+++ b/78/14502f303ea87bcc46822f89ec2b15047ab091
@@ -0,0 +1,100 @@
+Return-Path: <david@tethera.net>\r
+X-Original-To: notmuch@notmuchmail.org\r
+Delivered-To: notmuch@notmuchmail.org\r
+Received: from localhost (localhost [127.0.0.1])\r
+ by arlo.cworth.org (Postfix) with ESMTP id 7E2FA6DE1502\r
+ for <notmuch@notmuchmail.org>; Sun,  7 Jun 2015 23:04:11 -0700 (PDT)\r
+X-Virus-Scanned: Debian amavisd-new at cworth.org\r
+X-Spam-Flag: NO\r
+X-Spam-Score: 0.208\r
+X-Spam-Level: \r
+X-Spam-Status: No, score=0.208 tagged_above=-999 required=5 tests=[AWL=0.208]\r
+ autolearn=disabled\r
+Received: from arlo.cworth.org ([127.0.0.1])\r
+ by localhost (arlo.cworth.org [127.0.0.1]) (amavisd-new, port 10024)\r
+ with ESMTP id lBgrY67LLRfp for <notmuch@notmuchmail.org>;\r
+ Sun,  7 Jun 2015 23:04:09 -0700 (PDT)\r
+Received: from mx.xen14.node3324.gplhost.com (gitolite.debian.net\r
+ [87.98.215.224])\r
+ by arlo.cworth.org (Postfix) with ESMTPS id 387866DE119C\r
+ for <notmuch@notmuchmail.org>; Sun,  7 Jun 2015 23:04:08 -0700 (PDT)\r
+Received: from remotemail by mx.xen14.node3324.gplhost.com with local (Exim\r
+ 4.80) (envelope-from <david@tethera.net>)\r
+ id 1Z1q8v-0007Nv-5D; Mon, 08 Jun 2015 06:02:41 +0000\r
+Received: (nullmailer pid 29648 invoked by uid 1000); Mon, 08 Jun 2015\r
+ 06:02:22 -0000\r
+From: David Bremner <david@tethera.net>\r
+To: Morgan Veyret <morgan.veyret@gmail.com>, notmuch@notmuchmail.org\r
+Subject: Re: BUG: maildir flags sync with database relative path results in\r
+ corrupted filename\r
+In-Reply-To:\r
+ <CACMMjMLecmXopb8AATjE3UuCnNLOO+5Nmev5X8K-UostDEUdrQ@mail.gmail.com>\r
+References:\r
+ <CACMMjMLecmXopb8AATjE3UuCnNLOO+5Nmev5X8K-UostDEUdrQ@mail.gmail.com>\r
+User-Agent: Notmuch/0.20+15~ga1b054b (http://notmuchmail.org) Emacs/24.4.1\r
+ (x86_64-pc-linux-gnu)\r
+Date: Mon, 08 Jun 2015 08:02:22 +0200\r
+Message-ID: <871thmivpt.fsf@maritornes.cs.unb.ca>\r
+MIME-Version: 1.0\r
+Content-Type: multipart/mixed; boundary="=-=-="\r
+X-BeenThere: notmuch@notmuchmail.org\r
+X-Mailman-Version: 2.1.18\r
+Precedence: list\r
+List-Id: "Use and development of the notmuch mail system."\r
+ <notmuch.notmuchmail.org>\r
+List-Unsubscribe: <http://notmuchmail.org/mailman/options/notmuch>,\r
+ <mailto:notmuch-request@notmuchmail.org?subject=unsubscribe>\r
+List-Archive: <http://notmuchmail.org/pipermail/notmuch/>\r
+List-Post: <mailto:notmuch@notmuchmail.org>\r
+List-Help: <mailto:notmuch-request@notmuchmail.org?subject=help>\r
+List-Subscribe: <http://notmuchmail.org/mailman/listinfo/notmuch>,\r
+ <mailto:notmuch-request@notmuchmail.org?subject=subscribe>\r
+X-List-Received-Date: Mon, 08 Jun 2015 06:04:11 -0000\r
+\r
+--=-=-=\r
+Content-Type: text/plain\r
+\r
+Morgan Veyret <morgan.veyret@gmail.com> writes:\r
+\r
+>\r
+> As I understand it's expected that the database path should be absolute but\r
+> corrupting the database when the path is relative sounds dangerous.\r
+\r
+Thanks for the report.  I can see how this could happen, since the\r
+internal functions _notmuch_message_add_file_name and\r
+_notmuch_database_relative_path classify message filenames into absolute\r
+paths starting with the database path and paths relative to the database\r
+root.\r
+\r
+The obvious solution is to reject non-absolute paths in\r
+notmuch_database_open_verbose. A slightly friendlier approach would be\r
+to canonicalize the path, but this might have unforseen consequences for\r
+clients relying on the database path being exactly what they pass in.\r
+\r
+Can you see if the attached patch "fixes" it for you? You'll have to\r
+rebuild notmuch from source. The patch should apply to 0.20 or later.\r
+\r
+\r
+--=-=-=\r
+Content-Type: text/x-diff\r
+Content-Disposition: inline; filename=test.diff\r
+\r
+diff --git a/lib/database.cc b/lib/database.cc\r
+index 78a24f7..2a5b82a 100644\r
+--- a/lib/database.cc\r
++++ b/lib/database.cc\r
+@@ -847,6 +847,12 @@ notmuch_database_open_verbose (const char *path,\r
+       goto DONE;\r
+     }\r
+ \r
++    if (path[0] != '/') {\r
++      message = strdup ("Error: Database path must be absolute.\n");\r
++      status = NOTMUCH_STATUS_FILE_ERROR;\r
++      goto DONE;\r
++    }\r
++\r
+     if (! (notmuch_path = talloc_asprintf (local, "%s/%s", path, ".notmuch"))) {\r
+       message = strdup ("Out of memory\n");\r
+       status = NOTMUCH_STATUS_OUT_OF_MEMORY;\r
+\r
+--=-=-=--\r