lib-storage: LAYOUT=index: Fix accessing freed memory when deleting \Noselect parents

Broken by f5328d6f7e4a8e460c736fa0336f5766aa58abda

diff --git a/src/lib-storage/list/mailbox-list-index-backend.c b/src/lib-storage/list/mailbox-list-index-backend.c
index 6b42c01020e752809ce39a93fe5281f7a53a7883..15dac411a57ae920d5b3e2c1e9fa34e6f52dacfa 100644 (file)
--- a/src/lib-storage/list/mailbox-list-index-backend.c
+++ b/src/lib-storage/list/mailbox-list-index-backend.c
@@ -697,7 +697,7 @@ index_list_try_delete_nonexistent_parent(struct mailbox_list *_list,
 {
        struct index_mailbox_list *list =
                container_of(_list, struct index_mailbox_list, list);
-       struct mailbox_list_index_node *node, *parent = NULL;
+       struct mailbox_list_index_node *node;
        string_t *full_name;
        const char *p;
        char sep = mailbox_list_get_hierarchy_sep(_list);
@@ -723,14 +723,22 @@ index_list_try_delete_nonexistent_parent(struct mailbox_list *_list,
                           existant or not selectable, delete it */
                        str_truncate(full_name, 0);
                        mailbox_list_index_node_get_path(node, sep, full_name);
-                       parent = node->parent;
                        if (index_list_delete_entry(list, str_c(full_name), FALSE) < 0)
                                return -1;
+
+                       if ((p = strrchr(str_c(full_name), sep)) == NULL) {
+                               /* No occurrences of the hierarchy separator
+                                  could be found in the mailbox that was
+                                  just deleted. */
+                               node = NULL;
+                       } else {
+                               /* lookup parent node of the node just deleted */
+                               str_truncate(full_name, p - str_c(full_name));
+                               node = mailbox_list_index_lookup(_list, str_c(full_name));
+                       }
                } else
                        break;
 
-               /* If there is another parent attempt to delete it as well */
-               node = parent;
        }
        return 0;
 }