From: Kevin McCarthy <kevin@8t8.us>
Date: Wed, 12 Jul 2017 19:38:22 +0000 (-0700)
Subject: Fix crash when $postponed is on another server.
X-Git-Tag: neomutt-20170714~7^2~2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9ac6e2dd021b3c8bd777b70bb04d060c175f2a3a;p=neomutt

Fix crash when $postponed is on another server.

imap_mxcmp() translates NULL to "INBOX".  When $postponed points to a
URL with an empty or "INBOX" path, this will end up matching against a
NULL idata->mailbox in imap_status().  This resulted in a crash
because idata->ctx is also NULL.

Thanks to Olaf Hering for the detailed bug report and suggested fix.
---

diff --git a/imap/imap.c b/imap/imap.c
index bedd09867..2b064a4c2 100644
--- a/imap/imap.c
+++ b/imap/imap.c
@@ -1642,8 +1642,11 @@ int imap_status(char *path, int queue)
   if (imap_get_mailbox(path, &idata, buf, sizeof(buf)) < 0)
     return -1;
 
-  if (imap_mxcmp(buf, idata->mailbox) == 0)
-    /* We are in the folder we're polling - just return the mailbox count */
+  /* We are in the folder we're polling - just return the mailbox count.
+   *
+   * Note that imap_mxcmp() converts NULL to "INBOX", so we need to
+   * make sure the idata really is open to a folder. */
+  if (idata->ctx && !imap_mxcmp(buf, idata->mailbox))
     return idata->ctx->msgcount;
   else if (mutt_bit_isset(idata->capabilities, IMAP4REV1) ||
            mutt_bit_isset(idata->capabilities, STATUS))