[PATCH 2/6] Fix imap_delete_mailbox() double free and pass by value.

[Kevin J. McCarthy]

imap_delete_mailbox() was passing an IMAP_MBOX parameter
by value.  Change this to pass by reference.  Additionally,
imap_delete_mailbox() was free'ing mx.mbox in an error handler, which
the caller was also doing, leading to a possible double free.  So the
free inside the function was removed.
---
 browser.c   | 2 +-
 imap/imap.c | 7 +++----
 imap/imap.h | 2 +-
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/browser.c b/browser.c
index 7f3498ce..77d64174 100644
--- a/browser.c
+++ b/browser.c
@@ -1234,7 +1234,7 @@ void _mutt_buffer_select_file(BUFFER *f, int flags, char 
***files, int *numfiles
                    mx.mbox);
           if (mutt_yesorno(msg, MUTT_NO) == MUTT_YES)
           {
-            if (!imap_delete_mailbox(Context, mx))
+            if (!imap_delete_mailbox(Context, &mx))
             {
               /* free the mailbox from the browser */
               FREE(&((state.entry)[nentry].display_name));
diff --git a/imap/imap.c b/imap/imap.c
index cd3edcd9..a86a8379 100644
--- a/imap/imap.c
+++ b/imap/imap.c
@@ -153,17 +153,16 @@ int imap_rename_mailbox(IMAP_DATA *idata, IMAP_MBOX *mx, 
const char *newname)
   return rc;
 }
 
-int imap_delete_mailbox(CONTEXT *ctx, IMAP_MBOX mx)
+int imap_delete_mailbox(CONTEXT *ctx, IMAP_MBOX *mx)
 {
   char buf[LONG_STRING*2], mbox[LONG_STRING];
   IMAP_DATA *idata;
 
   if (!ctx || !ctx->data)
   {
-    if (!(idata = imap_conn_find(&mx.account,
+    if (!(idata = imap_conn_find(&mx->account,
                                  option(OPTIMAPPASSIVE) ? MUTT_IMAP_CONN_NONEW 
: 0)))
     {
-      FREE(&mx.mbox);
       return -1;
     }
   }
@@ -172,7 +171,7 @@ int imap_delete_mailbox(CONTEXT *ctx, IMAP_MBOX mx)
     idata = ctx->data;
   }
 
-  imap_munge_mbox_name(idata, mbox, sizeof(mbox), mx.mbox);
+  imap_munge_mbox_name(idata, mbox, sizeof(mbox), mx->mbox);
   snprintf(buf, sizeof(buf), "DELETE %s", mbox);
 
   if (imap_exec((IMAP_DATA*) idata, buf, 0) != 0)
diff --git a/imap/imap.h b/imap/imap.h
index 586f0a49..f2035e89 100644
--- a/imap/imap.h
+++ b/imap/imap.h
@@ -34,7 +34,7 @@ typedef struct
 /* imap.c */
 int imap_access(const char *path);
 int imap_check_mailbox(CONTEXT *ctx, int *index_hint, int force);
-int imap_delete_mailbox(CONTEXT *idata, IMAP_MBOX mx);
+int imap_delete_mailbox(CONTEXT *idata, IMAP_MBOX *mx);
 int imap_sync_mailbox(CONTEXT *ctx, int expunge, int *index_hint);
 int imap_close_mailbox(CONTEXT *ctx);
 int imap_buffy_check(int force, int check_stats);
-- 
2.55.0