talons

commit 4ab583e275576073a8831d55a8b7c6b4db1e5e3e
parent 2b61e4b2c77c80c0a91e11f81c58d41956a117de
Author: Ricardo Mones <ricardo@mones.org>
Date:   Wed, 13 Nov 2024 19:25:37 +0100

Fix bug 4840: core dump unsubscribing from newsgroups

Thanks claws-mail at sjh.sh for the patch.

Diffstat:
M
src/grouplistdialog.c
 | 
8
+++++++-

1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/src/grouplistdialog.c b/src/grouplistdialog.c
@@ -602,8 +602,14 @@ static gboolean button_press_cb(GtkCMCTree *ctree, GdkEventButton *button,
 	list = g_slist_find_custom(subscribed, ginfo->name,
 				   (GCompareFunc)g_ascii_strcasecmp);
 	if (list) {
+		/*
+		 * Make a copy so we can g_free() it after we remove
+		 * list from the subscribed list.  Calling g_free()
+		 * first triggers a use-after-free Coverity issue.
+		 */
+		gpointer tmpdata = list->data;
 		subscribed = g_slist_remove(subscribed, list->data);
-		g_free(list->data);
+		g_free(tmpdata);
 		gtk_cmclist_unselect_row(GTK_CMCLIST(ctree), row, 0);
 	} else {
 		subscribed = g_slist_append(subscribed, g_strdup(ginfo->name));