[Pan-users] use-after-free in latest pan.git

[walt]

Hi all.  This is a bug I reported some time ago, but I just learned about
the gcc -fsanitize=address option and now I have some fresh info, which I
don't know enough to interpret. (see attached)

Just today I noticed that all network activity stopped about ten seconds
before pan crashed.  Felt like I lost my internet connection for a short
time because another networked application had to stop and re-login at
exactly the same time pan crashed.

My amateur guess is that some networking code (gnutls?) timed out and
closed a connection to the news server without "telling" pan about it,
then pan continued on as if the connection were still there -- hence
the use-after-free. (This crash happens quite often when pan uses an
encrypted connection to the server.)

Thoughts?

fsanitize.txt
Description: Text document