]> granicus.if.org Git - neomutt/commit
Fix segfault when deleting and reusing attachment slots. (closes #3800)
authorKevin McCarthy <kevin@8t8.us>
Fri, 1 Jan 2016 17:48:51 +0000 (09:48 -0800)
committerKevin McCarthy <kevin@8t8.us>
Fri, 1 Jan 2016 17:48:51 +0000 (09:48 -0800)
commite4a8005e5e77e25d4b440303d7ade3010473c19a
tree5ca9299c9d30f9a9c66f8463da22b7b5efa5d709
parent9600523147e11e54a94771e48310bf0e5e77bfeb
Fix segfault when deleting and reusing attachment slots. (closes #3800)

When attachments are deleted, delete_attachment() slides the entries
down in the idx array, but forgets to NULL out the last vacated slot.

If more attachments are added later on via OP_COMPOSE_EDIT_HEADERS and
the Attach: pseudo-header, mutt_gen_attach_list() will attempt to
re-use the ATTACHPTR in that last slot because it wasn't set to NULL.
This will be pointing to freed memory and likely segfault (at best).
compose.c