From: Kevin McCarthy <kevin@8t8.us>
Date: Sun, 16 Oct 2016 21:16:47 +0000 (-0700)
Subject: Fix gpgme segfault in create_recipient_set().
X-Git-Tag: mutt-1-8-rel~119^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f3697a744da54089f5f58561e8ed44add5f7c0e0;p=mutt

Fix gpgme segfault in create_recipient_set().

If gpgme_get_key() errors on the first key, the rset will not be
allocated yet.  Attempting to null-terminate (and then free) the array
causes a segfault.
---

diff --git a/crypt-gpgme.c b/crypt-gpgme.c
index 6d8f3336..aab9a6e2 100644
--- a/crypt-gpgme.c
+++ b/crypt-gpgme.c
@@ -682,8 +682,11 @@ static gpgme_key_t *create_recipient_set (const char *keylist,
 	      {
 		mutt_error (_("error adding recipient `%s': %s\n"),
 			    buf, gpgme_strerror (err));
-		rset[rset_n] = NULL;
-		free_recipient_set (&rset);
+                if (rset)
+                  {
+                    rset[rset_n] = NULL;
+                    free_recipient_set (&rset);
+                  }
 		gpgme_release (context);
 		return NULL;
 	      }