Fix a memory leak in mutt_free_envelope(); avoid dangling pointers

in header editing.

diff --git a/headers.c b/headers.c
index 0dab00ee7904450bffb1800845f6fdb965dd38d9..6b7c084b0d7e9dbdb5d7795e9782b13c4fe828ad 100644 (file)
--- a/headers.c
+++ b/headers.c
@@ -109,11 +109,15 @@ void mutt_edit_headers (const char *editor,
   /* restore old info. */
   n->references = msg->env->references;
   msg->env->references = NULL;
+
   mutt_free_envelope (&msg->env);
-  msg->env = n;
+  msg->env = n; n = NULL;
+
+  if (!msg->env->in_reply_to)
+    mutt_free_list (&msg->env->references);
 
   mutt_expand_aliases_env (msg->env);
-  
+
   /* search through the user defined headers added to see if either a 
    * fcc: or attach-file: field was specified.  
    */
@@ -199,7 +203,4 @@ void mutt_edit_headers (const char *editor,
       mutt_free_list (&tmp);
     }
   }
-
-  if (!msg->env->in_reply_to)
-    mutt_free_list (&msg->env->references);
 }

diff --git a/muttlib.c b/muttlib.c
index d973514fa97f6dabef2d70c067f954ab592f80ea..694ff3692021bda5a76fb52560172910763b45a8 100644 (file)
--- a/muttlib.c
+++ b/muttlib.c
@@ -642,6 +642,7 @@ void mutt_free_envelope (ENVELOPE **p)
   safe_free ((void **) &(*p)->supersedes);
   safe_free ((void **) &(*p)->date);
   mutt_free_list (&(*p)->references);
+  mutt_free_list (&(*p)->in_reply_to);
   mutt_free_list (&(*p)->userhdrs);
   safe_free ((void **) p);
 }