talons

commit 1452caa22726992296a5a68904891661b03821b6
parent 00081bf42a2c4a02d3aa0e6fc2058f8cc49414b0
Author: Andrej Kacian <ticho@claws-mail.org>
Date:   Tue, 14 May 2019 16:01:40 +0200

Fix a use after free crash when deleting message via a separate messageview

After the message has been deleted, summary_show() will
redisplay the folder and free all the MsgInfos, but we still
need the one for the message currently displayed in our
messageview window, so we add our own reference to it, and free
it ourselves when we're done.

This was only happening when summaryview already has a different
message displayed.

Fixes bug #4029: segfault after deleting message in a window

Diffstat:
M
src/messageview.c
 | 
6
++++++

1 file changed, 6 insertions(+), 0 deletions(-)
diff --git a/src/messageview.c b/src/messageview.c
@@ -1666,6 +1666,10 @@ void messageview_delete(MessageView *msgview)
 
 		cm_return_if_fail(msginfo != NULL);
 
+		/* We will need to access the original message's msginfo
+		 * later, so we add our own reference. */
+		procmsg_msginfo_new_ref(msginfo);
+
 		/* to get the trash folder, we have to choose either
 		 * the folder's or account's trash default - we prefer
 		 * the one in the account prefs */
@@ -1689,6 +1693,8 @@ void messageview_delete(MessageView *msgview)
 			procmsg_msginfo_set_flags(msginfo, MSG_DELETED, 0);
 			/* NOTE: does not update to next message in summaryview */
 		}
+
+		procmsg_msginfo_free(&msginfo);
 	}
 #ifdef GENERIC_UMPC
 	if (msgview->window && !prefs_common.always_show_msg) {