From: Michael S. Tsirkin <mst@redhat.com>
Date: Thu, 8 Jan 2026 06:49:01 +0000 (-0500)
Subject: listcontrol: fix double-free in CTRL_RELEASE error path
X-Git-Tag: RELEASE_1_7_0~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=77c86bc82fc24ceaaaf7f92ffddd62c4e1b93588;p=thirdparty%2Fmlmmj.git

listcontrol: fix double-free in CTRL_RELEASE error path

moderatefilename is already freed before the autosubscribe block:

	free(moderatefilename);
	bool autosubscribe = statctrl(ml->ctrlfd, "autosubscribe");
	if (autosubscribe) {
		...
		if (mfd == -1) {
			free(sendfilename);
			free(moderatefilename);  // double-free
			return (-1);
		}

Remove the second free.

Fixes: ac7f7646 ("autosubscribe: new feature")
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---

diff --git a/src/listcontrol.c b/src/listcontrol.c
index 139898c8..2d4927d0 100644
--- a/src/listcontrol.c
+++ b/src/listcontrol.c
@@ -442,7 +442,6 @@ int listcontrol(strlist *fromemails, struct ml *ml, const char *controlstr,
 			int mfd = openat(ml->fd, sendfilename, O_RDONLY);
 			if (mfd == -1) {
 				free(sendfilename);
-				free(moderatefilename);
 				return (-1);
 			}
 			autosubscribe_sender(ml, mfd, SUB_NOMAIL);