From: Tomi Ollila <tomi.ollila@iki.fi>
Date: Fri, 17 Mar 2017 22:28:48 +0000 (+0200)
Subject: lib/message.cc: fix Coverity finding (use after free)
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=930920d5106e01d511dc339171ec3254e3d8771e;p=notmuch.git

lib/message.cc: fix Coverity finding (use after free)

The object where pointer to `data` was received was deleted before
it was used in _notmuch_string_list_append().

Relevant Coverity messages follow:

3: extract
Assigning: data = std::__cxx11::string(message->doc.()).c_str(),
which extracts wrapped state from temporary of type std::__cxx11::string.

4: dtor_free
The internal representation of temporary of type std::__cxx11::string
is freed by its destructor.

5: use after free:
Wrapper object use after free (WRAPPER_ESCAPE)
Using internal representation of destroyed object local data.

(cherry picked from commit 06adc276682d1d5f73d78df2e898ad4191eb4499)
---

diff --git a/lib/message.cc b/lib/message.cc
index 9d3e8071..a91e69e0 100644
--- a/lib/message.cc
+++ b/lib/message.cc
@@ -849,9 +849,9 @@ _notmuch_message_ensure_filename_list (notmuch_message_t *message)
 	 *
 	 * It would be nice to do the upgrade of the document directly
 	 * here, but the database is likely open in read-only mode. */
-	const char *data;
 
-	data = message->doc.get_data ().c_str ();
+	std::string datastr = message->doc.get_data ();
+	const char *data = datastr.c_str ();
 
 	if (data == NULL)
 	    INTERNAL_ERROR ("message with no filename");