Fix crash when $postponed is on another server.

imap_mxcmp() translates NULL to "INBOX".  When $postponed points to a
URL with an empty or "INBOX" path, this will end up matching against a
NULL idata->mailbox in imap_status().  This resulted in a crash
because idata->ctx is also NULL.

Thanks to Olaf Hering for the detailed bug report and suggested fix.

diff --git a/imap/imap.c b/imap/imap.c
index bedd09867e7758cd62e7c64648bcacccd24eb91d..2b064a4c26b3b0464dc52fda9a389027f5b52710 100644 (file)
--- a/imap/imap.c
+++ b/imap/imap.c
@@ -1642,8 +1642,11 @@ int imap_status(char *path, int queue)
   if (imap_get_mailbox(path, &idata, buf, sizeof(buf)) < 0)
     return -1;
 
-  if (imap_mxcmp(buf, idata->mailbox) == 0)
-    /* We are in the folder we're polling - just return the mailbox count */
+  /* We are in the folder we're polling - just return the mailbox count.
+   *
+   * Note that imap_mxcmp() converts NULL to "INBOX", so we need to
+   * make sure the idata really is open to a folder. */
+  if (idata->ctx && !imap_mxcmp(buf, idata->mailbox))
     return idata->ctx->msgcount;
   else if (mutt_bit_isset(idata->capabilities, IMAP4REV1) ||
            mutt_bit_isset(idata->capabilities, STATUS))