Verified Commit cde208e6 authored by
IMAP: fix use-after free in ChangeItemTask
The attribute pointer lives only as long as the owning Collection lives. Since the code here was taking the attribute from a temporary object, the uidNext() getter called below would return a garbage number.
Showing with 2 additions and 1 deletion