diff options
| author | Matthew Barnes <mbarnes@redhat.com> | 2013-12-04 17:31:17 -0500 |
|---|---|---|
| committer | Matthew Barnes <mbarnes@redhat.com> | 2013-12-04 17:38:12 -0500 |
| commit | 6b3765b89cd5164d894d6717cd328d18bc411593 (patch) | |
| tree | 68e60c40f696f7c6b7ce5546f2b8acd45bd2c08e | |
| parent | b70845d94720220f2d52c566c09f13d871adc7fc (diff) | |
| download | evolution-data-server-6b3765b89cd5164d894d6717cd328d18bc411593.tar.gz | |
Bug 710361 - GError corruption in imapx_command_fetch_message_done()
camel_imapx_job_take_error() was being called twice on the same GError.
The 2nd call freed the GError set in the 1st call, which corrupted the
memory. Put a safeguard in camel_imapx_job_take_error() to catch this
in the future.
| -rw-r--r-- | camel/camel-imapx-job.c | 1 | ||||
| -rw-r--r-- | camel/camel-imapx-server.c | 7 |
2 files changed, 4 insertions, 4 deletions
diff --git a/camel/camel-imapx-job.c b/camel/camel-imapx-job.c index 49c39884e..4b5941883 100644 --- a/camel/camel-imapx-job.c +++ b/camel/camel-imapx-job.c @@ -412,6 +412,7 @@ camel_imapx_job_take_error (CamelIMAPXJob *job, g_return_if_fail (error != NULL); real_job = (CamelIMAPXRealJob *) job; + g_return_if_fail (real_job->error != error); g_clear_error (&real_job->error); diff --git a/camel/camel-imapx-server.c b/camel/camel-imapx-server.c index dedbb4a05..f514a6a0b 100644 --- a/camel/camel-imapx-server.c +++ b/camel/camel-imapx-server.c @@ -4384,7 +4384,6 @@ imapx_command_fetch_message_done (CamelIMAPXServer *is, g_prefix_error ( &local_error, "%s: ", _("Error fetching message")); - camel_imapx_job_take_error (job, local_error); data->body_len = -1; } else if (data->use_multi_fetch) { @@ -4477,13 +4476,13 @@ imapx_command_fetch_message_done (CamelIMAPXServer *is, g_free (tmp_filename); } - if (local_error != NULL) - camel_imapx_job_take_error (job, local_error); - camel_data_cache_remove (ifolder->cache, "tmp", data->uid, NULL); imapx_unregister_job (is, job); exit: + if (local_error != NULL) + camel_imapx_job_take_error (job, local_error); + g_object_unref (folder); } |