segfault when fcc is set equal to INBOX using IMAP/SMTP

[otizonaizit]

Expected Behaviour

On several IMAP accounts I have the configuration variable "record" set to the same value as "spoolfile". The use case is that I want sent email to be stored in the INBOX, to have proper threads, without the need of Bcc to myself. When I send an email, neomutt sets Fcc to be "+INBOX" and the sent email gets copied to the INBOX.

Actual Behaviour

Starting from neomutt 20211029 on some of these IMAP accounts I get a crash, i.e. a segfault, everytime I send an email where Fcc is automatically set by neomutt to be "+INBOX". Notice that the email is saved to the INBOX before the crash, i.e. when I restart neomutt the email is there where I expect it. The problem was not there with neomutt 20211022, so I started a bisect and identified commit 72ba9a8 as the culprit. The last good commit is a4a02a4 .

If NeoMutt crashed, did your OS create a 'coredump' file?

I have not create a coredump, but I can if considered necessary

Steps to Reproduce

I can reproduce it always with some accounts using SMTP and IMAP. If needed I can try what are differences between the accounts where it happens.

How often does this happen?

It happens always with some accounts and never with other accounts. I don't see any clear difference between those, they all use some SMTP and IMAP servers.

When did it start to happen?

Commit 72ba9a8
My configuration was unchanged.

NeoMutt Version

NeoMutt 20211029
Copyright (C) 1996-2020 Michael R. Elkins and others.
NeoMutt comes with ABSOLUTELY NO WARRANTY; for details type 'neomutt -vv'.
NeoMutt is free software, and you are welcome to redistribute it
under certain conditions; type 'neomutt -vv' for details.

System: Linux 5.14.0-3-amd64 (x86_64)
ncurses: ncurses 6.2.20210905 (compiled with 6.2.20210905)
libidn: 1.38 (compiled with 1.38)
GPGME: 1.16.0-unknown
GnuTLS: 3.7.2
PCRE2: 10.39 2021-10-29
storage: tokyocabinet
compression: lz4, zlib, zstd

Configure options: --prefix=/home/tiziano/software/neomutt --gpgme --with-ui --gnutls --gss --idn --pcre2 --sasl --tokyocabinet --zstd --lz4 --zlib

Compilation CFLAGS: -g -O2 -std=c99 -D_ALL_SOURCE=1 -D_GNU_SOURCE=1 -D__EXTENSIONS__ -I/home/tiziano/software/neomutt/include -DNCURSES_WIDECHAR -isystem /usr/include/mit-krb5

Default options:
  +attach_headers_color +compose_to_sender +compress +cond_date +debug
  +encrypt_to_self +forgotten_attachments +forwref +ifdef +imap +index_color
  +initials +limit_current_thread +multiple_fcc +nested_if +new_mail +nntp +pop
  +progress +quasi_delete +regcomp +reply_with_xorig +sensible_browser +sidebar
  +skip_quoted +smtp +status_color +timeout +tls_sni +trash

Compile options:
  -autocrypt +fcntl -flock -fmemopen +futimens +getaddrinfo +gnutls +gpgme +gss
  +hcache -homespool +idn +inotify -locales_hack -lua -mixmaster +nls -notmuch
  -openssl +pcre2 +pgp +sasl +smime -sqlite +sun_attachment

MAILPATH="/var/mail"
PKGDATADIR="/home/tiziano/software/neomutt/share/neomutt"
SENDMAIL="/usr/sbin/sendmail"
SYSCONFDIR="/home/tiziano/software/neomutt/etc"

To learn more about NeoMutt, visit: https://neomutt.org
If you find a bug in NeoMutt, please raise an issue at:
    https://github.com/neomutt/neomutt/issues
or send an email to: <neomutt-devel@neomutt.org>

Extra Info

• Debian/Linux unstable
• I always use multiple copies of neomutt, one for each account
• Each copy of neomutt runs in a tmux panel

[kaiec]

I can confirm the bug, I also have FCC set to my Inbox. My guess would be the check, if the mailbox is set via mailboxes and the assumption that if the mailbox is hidden, it can be freed. In my case it works when the Inbox is set as one of mailboxes and it does not work if it isn't. So a workaround could be: add Inbox to mailboxes.

[0-wiz-0]

I just found this bug report. I have a similar one:
#3116
I think the problem in more general terms is that the segfault occurs if an FCC is to the mailbox that is currently open.
As I wrote in the other issue, I see it happening when I reply to a mail I've sent to another folder, and the outgoing copy is sent to the same folder.

[kaiec]

For me, the work around still works, could you check if this works for you, too? It would be plausible that it is the combination of both: when the mailbox is not in mailboxes (i.e. sidebar), it is freed, which according to your report is only a problem if it is currently open -- makes sense.

[0-wiz-0]

I have tried replying in a folder which is in 'mailboxes' and to which I'm subscribed via IMAP and didn't see it happen there.

[0-wiz-0]

Ok, so how do we proceed?
If we don't know how to fix this, I'd prefer to back out the commit 72ba9a8 since a leak is better than a segfault.

[otizonaizit]

I am using the workaround of adding the fcc (in my case it is the INBOX) to mailboxes like this mailboxes ! This fixes the segfault.

[0-wiz-0]

This seems fixed in the 20220408 release.