Fix crash when $postponed is on another server.

imap_mxcmp() translates NULL to "INBOX".  When $postponed points to a
URL with an empty or "INBOX" path, this will end up matching against a
NULL idata->mailbox in imap_status().  This resulted in a crash
because idata->ctx is also NULL.

Thanks to Olaf Hering for the detailed bug report and suggested fix.

diff --git a/imap/imap.c b/imap/imap.c
index 7b1060a99d78f48b0d8183c831d1ee2617d43b4e..b2c48a7b22aab61738c30546a7876fb3d71a3327 100644 (file)
--- a/imap/imap.c
+++ b/imap/imap.c
@@ -1627,8 +1627,11 @@ int imap_status (char* path, int queue)
   if (imap_get_mailbox (path, &idata, buf, sizeof (buf)) < 0)
     return -1;
 
-  if (!imap_mxcmp (buf, idata->mailbox))
-    /* We are in the folder we're polling - just return the mailbox count */
+  /* We are in the folder we're polling - just return the mailbox count.
+   *
+   * Note that imap_mxcmp() converts NULL to "INBOX", so we need to
+   * make sure the idata really is open to a folder. */
+  if (idata->ctx && !imap_mxcmp (buf, idata->mailbox))
     return idata->ctx->msgcount;
   else if (mutt_bit_isset(idata->capabilities,IMAP4REV1) ||
           mutt_bit_isset(idata->capabilities,STATUS))