lib-mail: message_binary_part_deserialize(): Return error if body lin…

…e count is too large

The input was unsigned int, so output must also fit into unsigned int.

src/lib-mail/message-binary-part.c

@@ -31,7 +31,8 @@ int message_binary_part_deserialize(pool_t pool, const void *data, size_t size,
 		if (numpack_decode(&p, end, &n1) < 0 ||
 		    numpack_decode(&p, end, &n2) < 0 ||
 		    numpack_decode(&p, end, &n3) < 0 ||
-		    numpack_decode(&p, end, &n4) < 0)
+		    numpack_decode(&p, end, &n4) < 0 ||
+		    n4 > UINT_MAX)
 			return -1;
 		part->physical_pos = n1;
 		part->binary_hdr_size = n2;