bug#39884: 27.0.50; Emacs may destroy outgoing email messages during sending

[Noam Postavsky]

tags 39884 + patch
quit

"Rainer Gemulla" <rgemulla@gmx.de> writes:

> During step 9, this statement is executed, but afterwards, the tag
> variable is not set to the list mentioned in the statement
> (seriously!). In my case, it had value 'Content-Type:
> multipart/alternative; boundary="====-=-="' right afterwards

Yes, it's due destructive modification of a quoted literal value.  To
catch it, I modified mml.el like this:

--- i/lisp/gnus/mml.el
+++ w/lisp/gnus/mml.el
@@ -216,6 +216,8 @@ mml-parse
     (with-syntax-table mml-syntax-table
       (mml-parse-1))))
 
+(defconst mml-text/plain-tag-literal-constant '(type . "text/plain"))
+
 (defun mml-parse-1 ()
   "Parse the current buffer as an MML document."
   (let (struct tag point contents charsets warn use-ascii no-markup-p raw)
@@ -281,7 +283,7 @@ mml-parse-1
            (setq tag (mml-read-tag)
                  no-markup-p nil
                  warn nil)
-         (setq tag (list 'part '(type . "text/plain"))
+         (setq tag (list 'part mml-text/plain-tag-literal-constant)
                no-markup-p t
                warn t))
        (setq raw (cdr (assq 'raw tag))

And added a debug check around setcdr as in the attached
bug-39884-bad-mml-parsing.el file.

bug-39884-bad-mml-parsing.el
Description: bug reproducer

This gives the backtrace:

setcdr-backtrace.txt
Description: backtrace from the guilty setcdr

The fix is simply to make a fresh cons instead of using a quoted literal
(your backquote fix macroexpands to the same thing, but it's not
sufficiently obvious enough for a human reader to realize that), this
should be safe enough to put on the emacs-27 branch:

>From 16c77ed31d836c374b37cbdf03947567fc7b8581 Mon Sep 17 00:00:00 2001
From: Noam Postavsky <npostavs@gmail.com>
Date: Thu, 16 Apr 2020 20:24:26 -0400
Subject: [PATCH] Don't let a code literal get modified in mml parsing
 (Bug#39884)

* lisp/gnus/mml.el (mml-parse-1): Make a fresh cons for the tag type,
because 'mml-generate-mime' destructively modifies it.
---
 lisp/gnus/mml.el | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lisp/gnus/mml.el b/lisp/gnus/mml.el
index cdd8f3d3a5..556cf0804a 100644
--- a/lisp/gnus/mml.el
+++ b/lisp/gnus/mml.el
@@ -281,7 +281,7 @@ mml-parse-1
            (setq tag (mml-read-tag)
                  no-markup-p nil
                  warn nil)
-         (setq tag (list 'part '(type . "text/plain"))
+         (setq tag (list 'part (cons 'type "text/plain"))
                no-markup-p t
                warn t))
        (setq raw (cdr (assq 'raw tag))
-- 
2.11.0