Fix two memory leaks when replying

1: em_utils_reply_to_message() can be passed a newly-created message (from
a current selection. It needs to unref it. Which means that when we pass it
a message which *isn't* newly-created, we have to obtain a ref of our own.
It was that or add a boolean parameter to tell it whether to unref or not.

2: emf_finalize() wasn't unreferencing emf->message -- so when we clone
the EMFormat in em_utils_message_to_html() and immediately unreference the
clone, a refcount on the message got leaked. Fix emf_finalize() to unref
emf->message as presumably it should.

3 files changed, 15 insertions, 4 deletions

diff --git a/mail/e-mail-reader-utils.c b/mail/e-mail-reader-utils.c
index 24655e72c7..8827375ed3 100644
--- a/mail/e-mail-reader-utils.c
+++ b/mail/e-mail-reader-utils.c
@@ -384,8 +384,11 @@ e_mail_reader_reply_to_message (EMailReader *reader, CamelMimeMessage *src_messa
 	if (!gtk_widget_get_mapped (GTK_WIDGET(web_view)))
 		goto whole_message;
 
-	if (!src_message)
+	if (!src_message) {
 		src_message = CAMEL_MIME_MESSAGE (EM_FORMAT (formatter)->message);
+		if (src_message)
+			g_object_ref(src_message);
+	}
 
 	if (!e_mail_reader_get_quote_from_selection (reader))
 		goto whole_message;
@@ -421,6 +424,7 @@ e_mail_reader_reply_to_message (EMailReader *reader, CamelMimeMessage *src_messa
 		CAMEL_MIME_PART (new_message),
 		selection, length, "text/html");
 
+	g_object_unref(src_message);
 	em_utils_reply_to_message (
 		folder, uid, new_message, reply_mode, NULL);
 
diff --git a/mail/e-mail-reader.c b/mail/e-mail-reader.c
index d9f49bfee0..74f0e7c544 100644
--- a/mail/e-mail-reader.c
+++ b/mail/e-mail-reader.c
@@ -832,6 +832,9 @@ action_mail_reply_all_check(CamelFolder *folder, const gchar *uid, CamelMimeMess
 	if (!message)
 		return;
 
+	/* get_message_free() will unref the message, so we need to take an
+	   extra ref for e_mail_reader_reply_to_message() to own. */
+	g_object_ref(message);
 	to = camel_mime_message_get_recipients (message, CAMEL_RECIPIENT_TYPE_TO);
 	cc = camel_mime_message_get_recipients (message, CAMEL_RECIPIENT_TYPE_CC);
 
diff --git a/mail/em-composer-utils.c b/mail/em-composer-utils.c
index e077e27e76..4884432492 100644
--- a/mail/em-composer-utils.c
+++ b/mail/em-composer-utils.c
@@ -2200,9 +2200,12 @@ reply_to_message(CamelFolder *folder, const gchar *uid, CamelMimeMessage *messag
 {
 	struct _reply_data *rd = user_data;
 
-	if (message != NULL)
+	if (message != NULL) {
+		/* get_message_free() will also unref the message, so we need
+		   an extra ref for em_utils_reply_to_message() to drop. */
+		g_object_ref(message);
 		em_utils_reply_to_message(folder, uid, message, rd->mode, rd->source);
-
+	}
 	if (rd->source)
 		g_object_unref(rd->source);
 	g_free(rd);
@@ -2223,7 +2226,7 @@ reply_to_message(CamelFolder *folder, const gchar *uid, CamelMimeMessage *messag
  *
  * If @message is non null, then it is used directly, @folder and @uid
  * may be supplied in order to update the message flags once it has
- * been replied to.
+ * been replied to. Note that @message will be unreferenced on completion.
  **/
 EMsgComposer *
 em_utils_reply_to_message(CamelFolder *folder, const gchar *uid, CamelMimeMessage *message, gint mode, EMFormat *source)
@@ -2286,6 +2289,7 @@ em_utils_reply_to_message(CamelFolder *folder, const gchar *uid, CamelMimeMessag
 
 	composer_set_body (composer, message, source);
 
+	g_object_unref(message);
 	emcs = g_object_get_data (G_OBJECT (composer), "emcs");
 	emcs_set_folder_info (emcs, folder, uid, flags, flags);