Verified Commit cde208e6 authored by Daniel Vrátil's avatar Daniel Vrátil 🤖

IMAP: fix use-after free in ChangeItemTask

The attribute pointer lives only as long as the owning Collection lives.
Since the code here was taking the attribute from a temporary object,
the uidNext() getter called below would return a garbage number.
parent 2ef90f7d
......@@ -189,7 +189,8 @@ void ChangeItemTask::triggerSearchJob()
if (!m_messageId.isEmpty()) {
search->setTerm(KIMAP::Term(QStringLiteral("Message-ID"), QString::fromLatin1(m_messageId)));
} else {
UidNextAttribute *uidNext = item().parentCollection().attribute<UidNextAttribute>();
const auto parent = item().parentCollection();
const UidNextAttribute *uidNext = parent.attribute<UidNextAttribute>();
if (!uidNext) {
qCWarning(IMAPRESOURCE_LOG) << "Failed to determine new uid.";
cancelTask(i18n("Could not determine the UID for the newly created message on the server"));
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment