Bug #680331 - Crash when replying to a message

3 files changed, 24 insertions, 6 deletions

diff --git a/em-format/e-mail-formatter-quote-message-rfc822.c b/em-format/e-mail-formatter-quote-message-rfc822.c
index fb5922c1af..531815d120 100644
--- a/em-format/e-mail-formatter-quote-message-rfc822.c
+++ b/em-format/e-mail-formatter-quote-message-rfc822.c
@@ -82,9 +82,12 @@ emfqe_message_rfc822_format (EMailFormatterExtension *extension,
 	g_free (header);
 
 	iter = e_mail_part_list_get_iter (context->parts, part->id);
+	if (!iter) {
+		return FALSE;
+	}
 
 	end = g_strconcat (part->id, ".end", NULL);
-	for (iter = iter->next; iter; iter = iter->next) {
+	for (iter = g_slist_next (iter); iter; iter = g_slist_next (iter)) {
 		EMailPart * p = iter->data;
 		if (!p)
 			continue;
@@ -111,7 +114,10 @@ emfqe_message_rfc822_format (EMailFormatterExtension *extension,
 			while (iter) {
 				p = iter->data;
 				if (!p) {
-					iter = iter->next;
+					iter = g_slist_next (iter);
+					if (!iter) {
+						break;
+					}
 					continue;
 				}
 
@@ -119,7 +125,10 @@ emfqe_message_rfc822_format (EMailFormatterExtension *extension,
 					break;
 				}
 
-				iter = iter->next;
+				iter = g_slist_next (iter);
+				if (!iter) {
+					break;
+				}
 			}
 			g_free (sub_end);
 			continue;
diff --git a/em-format/e-mail-formatter-quote.c b/em-format/e-mail-formatter-quote.c
index 8abb73130b..5245fee2ba 100644
--- a/em-format/e-mail-formatter-quote.c
+++ b/em-format/e-mail-formatter-quote.c
@@ -99,7 +99,7 @@ mail_formatter_quote_run (EMailFormatter *formatter,
 			"<blockquote type=cite>\n", cancellable, NULL);
 	}
 
-	for (iter = context->parts; iter; iter = iter->next) {
+	for (iter = context->parts; iter; iter = g_slist_next (iter)) {
 		EMailPart *part = iter->data;
 
 		if (!part)
@@ -116,16 +116,23 @@ mail_formatter_quote_run (EMailFormatter *formatter,
 			while (iter) {
 				EMailPart *p = iter->data;
 				if (!p) {
-					iter = iter->next;
+					iter = g_slist_next (iter);
+					if (!iter) {
+						break;
+					}
 					continue;
 				}
 
 				if (g_strcmp0 (p->id, end) == 0)
 					break;
 
-				iter = iter->next;
+				iter = g_slist_next (iter);
+				if (!iter) {
+					break;
+				}
 			}
 			g_free (end);
+
 			continue;
 		}
 
diff --git a/modules/prefer-plain/e-mail-parser-prefer-plain.c b/modules/prefer-plain/e-mail-parser-prefer-plain.c
index a325f51f18..4acf9078f9 100644
--- a/modules/prefer-plain/e-mail-parser-prefer-plain.c
+++ b/modules/prefer-plain/e-mail-parser-prefer-plain.c
@@ -322,6 +322,8 @@ empe_prefer_plain_parse (EMailParserExtension *extension,
 					cancellable));
 	}
 
+	g_string_truncate (part_id, partidlen);
+
 	return parts;
 }