$OpenBSD: patch-mh_c,v 1.1 2015/12/09 00:03:11 sthen Exp $

http://dev.mutt.org/trac/ticket/3797

Fix hash table key "use after free" in mh_check_mailbox().

Changeset 6538:f542783e257d
http://dev.mutt.org/trac/changeset/f542783e257d49af7d8a1096e60d406ca2acfde6

--- mh.c.orig	Tue Dec  8 23:57:42 2015
+++ mh.c	Tue Dec  8 23:58:36 2015
@@ -2106,7 +2106,11 @@ int mh_check_mailbox (CONTEXT * ctx, int *index_hint)
   fnames = hash_create (1031, 0);
 
   for (p = md; p; p = p->next)
-    hash_insert (fnames, p->h->path, p, 0);
+  {
+    /* the hash key must survive past the header, which is freed below. */
+    p->canon_fname = safe_strdup (p->h->path);
+    hash_insert (fnames, p->canon_fname, p, 0);
+  }
 
   for (i = 0; i < ctx->msgcount; i++)
   {
