Review request: tny_camel_header_dup_message_id does not allocate message ID



Hello all,
Please, review the attached patch and integrate it if it looks fine.
Here is the fix info:
1) Baseline code location:
URL: http://git.gitorious.org/tinymail/tinymail.git
Branch: tinymail-1-2
Commit: 7dcc00722078b8807f68ce5f4b2bb5a82466f685

2) Fix information:
The clients expect that the calls tny_camel_header_dup_message_id/tny_header_dup_message_id return an allocated content, but tinymail returns the pointer to the local data. This makes it possible that the data is released 2 times: by the client with g_free and internally in tinymail. This may result in a crash or memory corruption. One more reason for allocation of the result is that tinymain has a number of other xxx_header_dup_xxx methods and all they return allocated results.

Please, let me know if something is wrong with this fix.

Thank you,
Alexander


Alexander Chumakov
Architect

Teleca
24 Salganskaya St., Nizhny Novgorod, 603105, Russia
Phone: +78312788198, Fax: +78312577230
Alexander Chumakov teleca com
http://www.teleca.com/

Follow what's going on at Teleca's blog on http://www.whatsyourideaoftomorrow.blogspot.com/.

The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error please notify the sender immediately. The unauthorized use, disclosure, copying or alteration of this message is strictly prohibited.

>From 249b9c7b46e20220946b5ab4a31b1f28b215c79d Mon Sep 17 00:00:00 2001
From: alexander chumakov <alexander chumakov teleca com>
Date: Fri, 16 Apr 2010 09:28:47 +0400
Subject: [PATCH] tny_camel_header_dup_message_id should return an allocated message ID

---
 ChangeLog                            |    7 +++++++
 libtinymail-camel/tny-camel-header.c |   13 ++++++++++---
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index fd8889b..c88917d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2010-04-16  Alexander Chumakov  <alexander chumakov teleca com>
+
+	* libtinymail-camel/tny-camel-header.c (tny_camel_header_dup_message_id):
+	tny_camel_header_dup_message_id should return an allocated message ID,
+	otherwize a crash or memory corruption is possible when the client
+	tries to release the message ID with g_free
+
 2010-04-14  Sergio Villar Senin  <svillar igalia com>
 
 	* configure.ac: disable glib cast checks in code built for
diff --git a/libtinymail-camel/tny-camel-header.c b/libtinymail-camel/tny-camel-header.c
index 5e2ceeb..7e9f64e 100644
--- a/libtinymail-camel/tny-camel-header.c
+++ b/libtinymail-camel/tny-camel-header.c
@@ -312,14 +312,21 @@ tny_camel_header_dup_to (TnyHeader *self)
 static gchar*
 tny_camel_header_dup_message_id (TnyHeader *self)
 {
+	CamelSummaryMessageID *msg_id = NULL;
+	const CamelSummaryMessageID *original_msg_id;
 	TnyCamelHeader *me = TNY_CAMEL_HEADER (self);
-	gchar *retval = NULL;
 
 	camel_folder_summary_lock ();
-	retval = (gchar*) camel_message_info_message_id (me->info);
+
+	original_msg_id = camel_message_info_message_id (me->info);
+	if (original_msg_id) {
+		msg_id = g_new (CamelSummaryMessageID, 1);
+		msg_id->id = original_msg_id->id;
+	}
+
 	camel_folder_summary_unlock ();
 
-	return retval;
+	return (gchar *)msg_id;
 }
 
 
-- 
1.7.0



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]