From: Eric Sunshine <sunshine@sunshineco.com>
Date: Thu, 22 May 2025 18:33:59 GMT
Subject: Re: [PATCH 1/2] imap-send: fix bug causing cfg->folder being set to NULL
Message-ID: <CAPig+cQK6i1QdA-iAcpEybQq2GcXX2uKSaeN3_5GRR-5ScJzuw@mail.gmail.com>
In-Reply-To: <20250522183121.GB14871@coredump.intra.peff.net>

On Thu, May 22, 2025 at 2:31 PM Jeff King <peff@peff.net> wrote:
> On Thu, May 22, 2025 at 02:25:47PM -0400, Eric Sunshine wrote:
> > It's subjective, but I would probably fix this a little bit
> > differently and (to my mind) more simply:
> >
> >     response = cram(prompt, ctx->cfg->user, ctx->cfg->pass);
> >
> >     ret = socket_write(&ctx->imap->buf.sock, response, strlen(response));
> >     free(response);
> >     if (ret != strlen(response))
> >         return error("IMAP error: sending response failed");
>
> Doesn't that introduce a use-after-free for response? You'd have to
> store the strlen() result in a local variable.

You're correct, of course. Aditya, ignore my suggestion.