Merge tag 'debian/0.29.3-1'

notmuch release 0.29.3-1 for unstable (sid) [dgit]

[dgit distro=debian no-split --quilt=linear]

5 files changed, 32 insertions, 4 deletions

diff --git a/NEWS b/NEWS
index c416a373..66bb69f1 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,18 @@
+Notmuch 0.29.3 (2019-11-27)
+===========================
+
+General
+-------
+
+Fix for use-after-free in notmuch_config_list_{key,val}.
+
+Fix for double close of file in notmuch-dump.
+
+Debian
+------
+
+Drop python2 support from shipped debian packaging.
+
 Notmuch 0.29.2 (2019-10-19)
 ===========================
 
diff --git a/bindings/python/notmuch/version.py b/bindings/python/notmuch/version.py
index 1bde97e5..e688b565 100644
--- a/bindings/python/notmuch/version.py
+++ b/bindings/python/notmuch/version.py
@@ -1,3 +1,3 @@
 # this file should be kept in sync with ../../../version
-__VERSION__ = '0.29.2'
+__VERSION__ = '0.29.3'
 SOVERSION = '5'
diff --git a/debian/changelog b/debian/changelog
index 92b97449..4f7457cd 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+notmuch (0.29.3-1) unstable; urgency=medium
+
+  * New upstream bugfix release.
+    - fix use-after-free bug in libnotmuch
+    - fix double close of file in "notmuch dump"
+
+ -- David Bremner <bremner@debian.org>  Wed, 27 Nov 2019 08:19:57 -0400
+
 notmuch (0.29.2-2) experimental; urgency=medium
 
   * Drop python-notmuch binary package.
diff --git a/lib/config.cc b/lib/config.cc
index 8ee4da01..292f0288 100644
--- a/lib/config.cc
+++ b/lib/config.cc
@@ -150,13 +150,17 @@ notmuch_config_list_valid (notmuch_config_list_t *metadata)
     return true;
 }
 
+static inline char * _key_from_iterator (notmuch_config_list_t *list) {
+    return talloc_strdup (list, (*list->iterator).c_str () + CONFIG_PREFIX.length ());
+}
+
 const char *
 notmuch_config_list_key (notmuch_config_list_t *list)
 {
     if (list->current_key)
 	talloc_free (list->current_key);
 
-    list->current_key = talloc_strdup (list, (*list->iterator).c_str () + CONFIG_PREFIX.length ());
+    list->current_key = _key_from_iterator (list);
 
     return list->current_key;
 }
@@ -166,7 +170,7 @@ notmuch_config_list_value (notmuch_config_list_t *list)
 {
     std::string strval;
     notmuch_status_t status;
-    const char *key = notmuch_config_list_key (list);
+    char *key = _key_from_iterator (list);
 
     /* TODO: better error reporting?? */
     status = _metadata_value (list->notmuch, key, strval);
@@ -177,6 +181,7 @@ notmuch_config_list_value (notmuch_config_list_t *list)
 	talloc_free (list->current_val);
 
     list->current_val = talloc_strdup (list, strval.c_str ());
+    talloc_free (key);
     return list->current_val;
 }
 
diff --git a/version b/version
index 20f06870..5540b6e0 100644
--- a/version
+++ b/version
@@ -1 +1 @@
-0.29.2
+0.29.3