From: Jeff King <peff@peff.net>
Date: Thu, 22 May 2025 18:31:21 GMT
Subject: Re: [PATCH 1/2] imap-send: fix bug causing cfg->folder being set to NULL
Message-ID: <20250522183121.GB14871@coredump.intra.peff.net>
In-Reply-To: <CAPig+cTJmeczzUcGrn98svMfK7aODYS-Ha8FxJHuKU2c2+R-FQ@mail.gmail.com>

On Thu, May 22, 2025 at 02:25:47PM -0400, Eric Sunshine wrote:

> It's subjective, but I would probably fix this a little bit
> differently and (to my mind) more simply:
> 
>     response = cram(prompt, ctx->cfg->user, ctx->cfg->pass);
> 
>     ret = socket_write(&ctx->imap->buf.sock, response, strlen(response));
>     free(response);
>     if (ret != strlen(response))
>         return error("IMAP error: sending response failed");

Doesn't that introduce a use-after-free for response? You'd have to
store the strlen() result in a local variable.

-Peff