Skip to content
  • Daniel Vrátil's avatar
    IMAP: fix use-after free in ChangeItemTask · cde208e6
    Daniel Vrátil authored
    The attribute pointer lives only as long as the owning Collection lives.
    Since the code here was taking the attribute from a temporary object,
    the uidNext() getter called below would return a garbage number.
    cde208e6