Browse code

b11939: adding fix as recommended by bug reporter along with a couple extra lines to ensure freed pointers are set to NULL.

Micah Snyder authored on 2017/10/30 06:35:00
Showing 3 changed files
... ...
@@ -2365,7 +2365,7 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re
2365 2365
 				 * bother saving to scan, it's safe
2366 2366
 				 */
2367 2367
 				saveIt = (bool)(encodingLine(mainMessage) != NULL);
2368
-			else if((t_line = encodingLine(mainMessage)) != NULL) {
2368
+			else if(mainMessage->body_last != NULL && (t_line = encodingLine(mainMessage)) != NULL) {
2369 2369
 				/*
2370 2370
 				 * Some bounces include the message
2371 2371
 				 * body without the headers.
... ...
@@ -1075,8 +1075,10 @@ messageMoveText(message *m, text *t, message *old_message)
1075 1075
 			for(u = old_message->body_first; u != t;) {
1076 1076
 				text *next;
1077 1077
 
1078
-				if(u->t_line)
1078
+				if(u->t_line) {
1079 1079
 					lineUnlink(u->t_line);
1080
+					u->t_line = NULL;
1081
+				}
1080 1082
 				next = u->t_next;
1081 1083
 
1082 1084
 				free(u);
... ...
@@ -124,8 +124,10 @@ textDestroy(text *t_head)
124 124
 {
125 125
 	while(t_head) {
126 126
 		text *t_next = t_head->t_next;
127
-		if(t_head->t_line)
128
-			(void)lineUnlink(t_head->t_line);
127
+		if(t_head->t_line) {
128
+			lineUnlink(t_head->t_line);
129
+			t_head->t_line = NULL;
130
+		}
129 131
 		free(t_head);
130 132
 		t_head = t_next;
131 133
 	}
... ...
@@ -146,12 +148,14 @@ textCopy(const text *t_head)
146 146
 		}
147 147
 
148 148
 		if(last == NULL) {
149
-            cli_errmsg("textCopy: Unable to allocate memory to clone object\n");
149
+			cli_errmsg("textCopy: Unable to allocate memory to clone object\n");
150 150
 			if(first)
151 151
 				textDestroy(first);
152 152
 			return NULL;
153 153
 		}
154 154
 
155
+		last->t_next = NULL;
156
+
155 157
 		if(t_head->t_line)
156 158
 			last->t_line = lineLink(t_head->t_line);
157 159
 		else