From: Kevin McCarthy <kevin@8t8.us>
Date: Fri, 22 Sep 2017 18:07:27 +0000 (-0700)
Subject: Fix imap sync segfault due to inactive headers during an expunge.  (closes #3971)
X-Git-Tag: mutt-1-9-1-rel~3
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a4dbae76e839e14f22ba5509ea22db2e75358f15;p=mutt

Fix imap sync segfault due to inactive headers during an expunge.  (closes #3971)

Mutt has several places where it turns off h->active as a hack.  For
example to avoid FLAG updates, or to exclude from imap_exec_msgset.

Unfortunately, when a reopen is allowed and the IMAP_EXPUNGE_PENDING
flag becomes set (e.g. a flag update to a modified header),
imap_expunge_mailbox() will be called by imap_cmd_finish().

The mx_update_tables() would free and remove these "inactive" headers,
despite that an EXPUNGE was not received for them.  This would result
in memory leaks and segfaults due to dangling pointers in the
msn_index and uid_hash.

There should probably be a more elegant solution, removing the initial
hacks.  However, this is causing a segfault, and the best solution
right now is to turn active back on for non-expunged messages in
imap_expunge_mailbox().

Extra thanks to chdiza, who bravely runs tip and found this issue
quickly.
---

diff --git a/imap/imap.c b/imap/imap.c
index e757c688..e81de863 100644
--- a/imap/imap.c
+++ b/imap/imap.c
@@ -290,7 +290,26 @@ void imap_expunge_mailbox (IMAP_DATA* idata)
       imap_free_header_data ((IMAP_HEADER_DATA**)&h->data);
     }
     else
+    {
       h->index = i;
+      /* Mutt has several places where it turns off h->active as a
+       * hack.  For example to avoid FLAG updates, or to exclude from
+       * imap_exec_msgset.
+       *
+       * Unfortunately, when a reopen is allowed and the IMAP_EXPUNGE_PENDING
+       * flag becomes set (e.g. a flag update to a modified header),
+       * this function will be called by imap_cmd_finish().
+       *
+       * The mx_update_tables() will free and remove these "inactive" headers,
+       * despite that an EXPUNGE was not received for them.
+       * This would result in memory leaks and segfaults due to dangling
+       * pointers in the msn_index and uid_hash.
+       *
+       * So this is another hack to work around the hacks.  We don't want to
+       * remove the messages, so make sure active is on.
+       */
+      h->active = 1;
+    }
   }
 
 #if USE_HCACHE