From urs at tin.org  Sun Dec  1 15:29:56 2024
From: urs at tin.org (Urs =?UTF-8?Q?Jan=C3=9Fen?=)
Date: Sun, 01 Dec 2024 15:29:56 +0100
Subject: [tin-dev] [tin 2.6.4] snapshots
References: <E1rdmVK-00BeWA-A9@akkuser.akk.kit.edu>
 <E1sPIXg-0088KN-Kb@akkuser.akk.kit.edu>
 <mailman.2431.1720084458.1791.tin-dev@tin.org>
 <E1sZYmC-005htc-Pq@akkuser.akk.kit.edu>
 <mailman.2441.1722530142.1791.tin-dev@tin.org>
 <E1sqYQH-004qV0-3B@akkuser.akk.kit.edu>
 <mailman.2460.1726580360.1791.tin-dev@tin.org>
 <E1t297S-004FDt-0R@akkuser.akk.kit.edu>
 <mailman.10.1729343028.1716.tin-dev@tin.org>
 <E1t9Yhx-00Duh6-2j@akkuser.akk.kit.edu>
 <mailman.20.1731109689.1716.tin-dev@tin.org>
 <E1tGi4p-003sWt-1I@akkuser.akk.kit.edu>
 <mailman.38.1732813997.1716.tin-dev@tin.org>
Message-ID: <E1tHkxQ-007Uzg-34@akkuser.akk.kit.edu>

The following patch fixes a double-free /  NULL pointer dereference
for quote_chars used in attributes (1st part) and memleaks for
news_headers_to_display and news_headers_to_not_display used in attributes
(2nd part).

=== modified file 'src/attrib.c'
--- old/src/attrib.c	2024-11-25 19:56:05 +0000
+++ new/src/attrib.c	2024-12-01 14:06:21 +0000
@@ -471,6 +471,7 @@
 						quote_dash_to_space(buf);
 						*tmp = my_strdup(buf);
 						set_attrib(OPT_ATTRIB_QUOTE_CHARS, scope, line, *tmp);
+						*tmp = NULL;
 						found = TRUE;
 						break;
 					}
@@ -837,23 +838,33 @@
 				SET_BOOLEAN(mark_saved_read);
 
 			case OPT_ATTRIB_NEWS_HEADERS_TO_DISPLAY:
-				if (!curr_scope->attribute->news_headers_to_display)
-					curr_scope->attribute->news_headers_to_display = my_malloc(sizeof(char *));
-				else
-					FreeIfNeeded(*curr_scope->attribute->news_headers_to_display);
-				*curr_scope->attribute->news_headers_to_display = my_strdup((char *) data);
-				build_news_headers_array(curr_scope->attribute, TRUE);
-				curr_scope->state->news_headers_to_display = TRUE;
+				{
+					char *tmp = (char *) data;
+
+					if (!curr_scope->attribute->news_headers_to_display)
+						curr_scope->attribute->news_headers_to_display = my_malloc(sizeof(char *));
+					else
+						FreeIfNeeded(*curr_scope->attribute->news_headers_to_display);
+					*curr_scope->attribute->news_headers_to_display = my_strdup(tmp);
+					FreeAndNull(tmp);
+					build_news_headers_array(curr_scope->attribute, TRUE);
+					curr_scope->state->news_headers_to_display = TRUE;
+				}
 				break;
 
 			case OPT_ATTRIB_NEWS_HEADERS_TO_NOT_DISPLAY:
-				if (!curr_scope->attribute->news_headers_to_not_display)
-					curr_scope->attribute->news_headers_to_not_display = my_malloc(sizeof(char *));
-				else
-					FreeIfNeeded(*curr_scope->attribute->news_headers_to_not_display);
-				*curr_scope->attribute->news_headers_to_not_display = my_strdup((char *) data);
-				build_news_headers_array(curr_scope->attribute, FALSE);
-				curr_scope->state->news_headers_to_not_display = TRUE;
+				{
+					char *tmp = (char *) data;
+
+					if (!curr_scope->attribute->news_headers_to_not_display)
+						curr_scope->attribute->news_headers_to_not_display = my_malloc(sizeof(char *));
+					else
+						FreeIfNeeded(*curr_scope->attribute->news_headers_to_not_display);
+					*curr_scope->attribute->news_headers_to_not_display = my_strdup(tmp);
+					FreeAndNull(tmp);
+					build_news_headers_array(curr_scope->attribute, FALSE);
+					curr_scope->state->news_headers_to_not_display = TRUE;
+				}
 				break;
 
 			case OPT_ATTRIB_POS_FIRST_UNREAD: