From 946ddda2565e28600b65cb666a59182a6d95ff48 Mon Sep 17 00:00:00 2001
From: Ken Hornstein <kenh@pobox.com>
Date: Fri, 9 Feb 2018 23:15:32 -0500
Subject: [PATCH] Clean up memory leaks by callers of scan().

Make sure we reuse the "scanl" argument to the scan() function, as that's
the signal to have scan() reuse it's buffers.  Otherwise repeated calls
to scan will leak a TON of memory.  Reported by Ralph Corderoy.
---
 uip/inc.c  | 21 +++++++++++++--------
 uip/scan.c | 12 +++++++-----
 2 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/uip/inc.c b/uip/inc.c
index 03443077..fecef370 100644
--- a/uip/inc.c
+++ b/uip/inc.c
@@ -217,6 +217,7 @@ main (int argc, char **argv)
     FILE *aud = NULL;
     char b[PATH_MAX + 1];
     char *maildir_copy = NULL;	/* copy of mail directory because the static gets overwritten */
+    charstring_t scanl = NULL;
 
     int nmsgs, nbytes;
     char *MAILHOST_env_variable;
@@ -613,7 +614,6 @@ main (int argc, char **argv)
 
         hghnum = msgnum = mp->hghmsg;
 	for (i = 1; i <= nmsgs; i++) {
-	    charstring_t scanl = NULL;
 
 	    msgnum++;
             cp = mh_xstrdup(m_name (msgnum));
@@ -655,7 +655,9 @@ main (int argc, char **argv)
 		    fflush (stdout);
 		break;
 	    }
-	    charstring_free (scanl);
+
+	    if (scanl)
+		charstring_clear (scanl);
 
             if (ferror(pf) || fclose (pf)) {
                 int e = errno;
@@ -672,6 +674,9 @@ main (int argc, char **argv)
 	    scan_finished();
 	}
 
+	charstring_free (scanl);
+	scanl = NULL;
+
 	if (pop_quit () == NOTOK)
 	    die("%s", response);
 
@@ -681,8 +686,6 @@ main (int argc, char **argv)
 	scan_detect_mbox_style (in);		/* the MAGIC invocation... */
 	hghnum = msgnum = mp->hghmsg;
 	for (;;) {
-	    charstring_t scanl = NULL;
-
 	    /* create scanline for new message */
 	    switch (incerr = scan (in, msgnum + 1, msgnum + 1, nfs, width,
 			      msgnum == hghnum && chgflag, 1, NULL, 0L, noisy,
@@ -719,16 +722,18 @@ main (int argc, char **argv)
 		if (noisy)
 		    fflush (stdout);
 
+		charstring_clear (scanl);
 		msgnum++;
 		continue;
 	    }
-	    charstring_free (scanl);
 
 	    /* If we get here there was some sort of error from scan(),
 	     * so stop processing anything more from the spool.
 	     */
 	    break;
 	}
+	charstring_free (scanl);
+	scanl = NULL;
 
     } else {
         /* Mail from Maildir. */
@@ -738,8 +743,6 @@ main (int argc, char **argv)
 
 	hghnum = msgnum = mp->hghmsg;
 	for (i = 0; i < num_maildir_entries; i++) {
-	    charstring_t scanl = NULL;
-
 	    msgnum++;
 
 	    sp = Maildir[i].filename;
@@ -803,7 +806,7 @@ main (int argc, char **argv)
 		    fflush (stdout);
 		break;
 	    }
-	    charstring_free (scanl);
+	    charstring_clear (scanl);
 
 	    if (ferror(pf) || fclose (pf)) {
 		int e = errno;
@@ -821,6 +824,8 @@ main (int argc, char **argv)
 	    scan_finished();
 	}
 	free (Maildir); /* From now on Maildir is just a flag - don't dref! */
+	charstring_free (scanl);
+	scanl = NULL;
     }
 
     scan_finished ();
diff --git a/uip/scan.c b/uip/scan.c
index b682ddd9..b999378b 100644
--- a/uip/scan.c
+++ b/uip/scan.c
@@ -76,6 +76,7 @@ main (int argc, char **argv)
     char **argp, *nfs, **arguments;
     struct msgs_array msgs = { 0, 0, NULL };
     struct msgs *mp;
+    charstring_t scanl = NULL;
     FILE *in;
 
     if (nmh_init(argv[0], true, true)) { return 1; }
@@ -190,14 +191,14 @@ main (int argc, char **argv)
 
 	scan_detect_mbox_style (in);
 	for (msgnum = 1; ; ++msgnum) {
-	    charstring_t scanl = NULL;
-
 	    state = scan (in, msgnum, -1, nfs, width, 0, 0,
 			  hdrflag ? file : NULL, 0L, 1, &scanl);
-	    charstring_free (scanl);
+	    if (scanl)
+		charstring_clear(scanl);
 	    if (state != SCNMSG && state != SCNENC)
 		break;
 	}
+	charstring_free (scanl);
 	scan_finished ();
 	fclose (in);
 	done (0);
@@ -256,7 +257,6 @@ main (int argc, char **argv)
 	 (revflag ? msgnum >= mp->lowsel : msgnum <= mp->hghsel);
 	 msgnum += (revflag ? -1 : 1)) {
 	if (is_selected(mp, msgnum)) {
-	    charstring_t scanl = NULL;
 
 	    if ((in = fopen (cp = m_name (msgnum), "r")) == NULL) {
 		    admonish (cp, "unable to open message");
@@ -294,7 +294,8 @@ main (int argc, char **argv)
 		    inform("message %d: empty", msgnum);
 		    break;
 	    }
-	    charstring_free (scanl);
+	    if (scanl)
+		charstring_clear(scanl);
 	    scan_finished ();
 	    hdrflag = false;
 	    fclose (in);
@@ -302,6 +303,7 @@ main (int argc, char **argv)
 		fflush (stdout);
 	}
     }
+    charstring_free (scanl);
 
     ivector_free (seqnum);
     folder_free (mp);	/* free folder/message structure */
-- 
2.56.0