<<< Date Index >>>     <<< Thread Index >>>

Re: crash in imap_expunge_mailbox (similar to #2175)



I found another crash, in mx_update_context, in mx.c (around line 1577). The avoidance is simple:


 for (msgno = ctx->msgcount - new_messages; msgno < ctx->msgcount; msgno++)
 {
   h = ctx->hdrs[msgno];

+   if (! h) continue;
   if (WithCrypto)
   {
     /* NOTE: this _must_ be done before the check for mailcap! */

It seems to have the same cause as the previous crashes: ctx->msgcount is longer than the ctx->hdrs array. I compared msgcount to the actual contents of my mailbox at the time of the crash, and it looks like msgcount is *CORRECT*, but that the rest of the ctx structure hasn’t been filled in for those additional messages.

On Thursday, February  9 at 04:49 PM, quoth Brendan Cully:
On Thursday, 09 February 2006 at 15:05, Kyle Wheeler wrote:
Along the same lines as bug #2175, I got a crash somewhere else in the imap support, for a similar reason. This crash was in imap_expunge_mailbox, inside a loop through idata->ctx->hdrs. For whatever reason, it looks like idata->ctx->msgcount isn't always an accurate count of how many hdrs have been stored in idata->ctx->hdrs.

This is probably the same as your other bug report (about bogus
\Replied flags). I think mutt's getting flag updates for other
messages while it's parsing a different one, and getting
confused. I've just had a hard time putting together more than a half
an hour for mutt lately, I'm afraid...


~Kyle
--
Being powerful is like being a lady. If you have to tell people you are, you aren't.
                                                   -- Margaret Thatcher

Attachment: pgpg5CCr1WSsP.pgp
Description: PGP signature