- imap_logout_all assumed every connection with descriptor value !=

  0 to be ready for reading/writing. Unfortunately when the
  descriptor was closed, conn->fd remained untouched. This is why
  mutt segfaulted if IMAP login was aborted with ^G.

- ssl_socket_close was called without calling ssl_socket_open first.
  This caused a segfault because conn->sockdata was NULL. Apparently
  there was also a memory leak, because conn->sockdata was never
  free'd :-]

2 files changed, 13 insertions, 9 deletions

diff --git a/imap/imap_ssl.c b/imap/imap_ssl.c
index 13a0cb36..bd13b09b 100644
--- a/imap/imap_ssl.c
+++ b/imap/imap_ssl.c
@@ -230,11 +230,14 @@ int ssl_socket_open (CONNECTION * conn)
 int ssl_socket_close (CONNECTION * conn)
 {
   sslsockdata *data = conn->sockdata;
-  SSL_shutdown (data->ssl);
+  if (data) {
+    SSL_shutdown (data->ssl);
 
-  X509_free (data->cert);
-  SSL_free (data->ssl);
-  SSL_CTX_free (data->ctx);
+    X509_free (data->cert);
+    SSL_free (data->ssl);
+    SSL_CTX_free (data->ctx);
+    safe_free ((void **) &conn->sockdata);
+  }
 
   return raw_socket_close (conn);
 }
diff --git a/imap/socket.c b/imap/socket.c
index 2b97bca7..aea2b69d 100644
--- a/imap/socket.c
+++ b/imap/socket.c
@@ -133,8 +133,7 @@ CONNECTION *mutt_socket_select_connection (const IMAP_MBOX *mx, int newconn)
     }
   }
   conn = (CONNECTION *) safe_calloc (1, sizeof (CONNECTION));
-  conn->bufpos = 0;
-  conn->available = 0;
+  conn->fd = -1;
   memcpy (&conn->mx, mx, sizeof (conn->mx));
   conn->mx.mbox = 0;
   conn->preconnect = safe_strdup (ImapPreconnect); 
@@ -171,7 +170,7 @@ void imap_logout_all (void)
   while (conn)
   {
     /* what's up here? the last connection doesn't seem to be used */
-    if (conn->fd)
+    if (conn->fd >= 0)
     {
       snprintf (buf, sizeof (buf), _("Closing connection to %s..."),
         conn->mx.host);
@@ -218,7 +217,7 @@ static int try_socket_and_connect (CONNECTION *conn, struct sockaddr_in sin,
 
   if (connect (conn->fd, (struct sockaddr *) &sin, sizeof (sin)) < 0)
   {
-    close (conn->fd);
+    raw_socket_close (conn);
     if (verbose) 
     {
       mutt_perror ("connect");
@@ -232,7 +231,9 @@ static int try_socket_and_connect (CONNECTION *conn, struct sockaddr_in sin,
 
 int raw_socket_close (CONNECTION *conn)
 {
-  return close (conn->fd);
+  /* Close the descriptor and set it to -1 if successful.
+   * Returns the error code from close */
+  return close (conn->fd) || !(conn->fd = -1);
 }
 
 int raw_socket_read (CONNECTION *conn)