[Users] [Bug 1684] view news messages with large attachements segfaults

[noreply at thewildbeast.co.uk]

http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=1684

--- Comment #22 from Ricardo Mones <mones at users.sourceforge.net> ---
Created attachment 1257
  -->
http://www.thewildbeast.co.uk/claws-mail/bugzilla/attachment.cgi?id=1257&action=edit
Proposed fix

Thanks Sthephan for the backtraces.

>From what I see following the code flow, the g_free(result); line causing the
crash is wrong. The data returned into result in the end comes from a
libEtPan's "str" member in a MMAPString structure, which is not allocated by
glib functions but by the malloc/realloc functions (src/data-types/mmapstring.c
in libEtPan).

Going a bit further, seems the MMAPString used for reading the article (see
mailstream_read_multiline in mailstream_helper.c) is simply reused (first call
is mmap_string_assign(multiline_buffer, "")), so the buffer is not intended to
be freed by the caller.

To summarise, can build from 3.9.0 sources with the attached patch applied and
see if it stops crashing? :)

-- 
You are receiving this mail because:
You are the assignee for the bug.