From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org
X-Spam-Level: 
X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=ham
	autolearn_force=no version=3.4.4
Received: (qmail 20993 invoked from network); 29 Jan 2022 21:00:31 -0000
Received: from 4ess.inri.net (216.126.196.42)
  by inbox.vuxu.org with ESMTPUTF8; 29 Jan 2022 21:00:31 -0000
Received: from duke.felloff.net ([216.126.196.34]) by 4ess; Sat Jan 29 15:50:48 -0500 2022
Message-ID: <90050617726D475C720E8A8581DA8945@felloff.net>
Date: Sat, 29 Jan 2022 21:50:36 +0100
From: cinap_lenrek@felloff.net
To: 9front@9front.org
In-Reply-To: <5E2CFE7F0D34E3CD03F6902FB308D936@felloff.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
List-ID: <9front.9front.org>
List-Help: <http://lists.9front.org>
X-Glyph: ➈
X-Bullshit: object-oriented basic JSON wrapper general-purpose layer 
Subject: Re: [9front] rewrite gateway
Reply-To: 9front@9front.org
Precedence: bulk

found it. i could reproduce it on 386 when replying to a message.

the issue was a classical double-free in msgshow(), calling
Bterm() twite on wfd:

251c3cfd610abd169676852d301a2aa1267c0e57 acne/Mail: fix double-free (Bterm() in mesgshow())
Hash: 251c3cfd610abd169676852d301a2aa1267c0e57
Date: Sat Jan 29 21:50:03 CET 2022
Author: cinap_lenrek <cinap_lenrek@felloff.net>
Message: acne/Mail: fix double-free (Bterm() in mesgshow())

--- .git/fs/object/2833aecc681aec9928c525fc2d8d023dbfe225bc/tree/sys/src/cmd/upas/Mail/comp.c
+++ .git/fs/object/251c3cfd610abd169676852d301a2aa1267c0e57/tree/sys/src/cmd/upas/Mail/comp.c
diff -u .git/fs/object/2833aecc681aec9928c525fc2d8d023dbfe225bc/tree/sys/src/cmd/upas/Mail/comp.c .git/fs/object/251c3cfd610abd169676852d301a2aa1267c0e57/tree/sys/src/cmd/upas/Mail/comp.c
@@ -283,7 +283,6 @@
 					break;
 			Bterm(rfd);
 		}
-		Bterm(wfd);
 	}
 	Bterm(wfd);
 	fprint(c->addr, "$");

--
cinap