net_imap: Fix crash in unsolicited STATUS with remote mailbox selected.

With NOTIFY enabled, if a new message arrived to a local mailbox while
a remote mailbox is selected, when generating the untagged STATUS,
a NULL dereference would occur since adding APPENDLIMIT involves
a call to mailbox_quota, but imap->mbox would be NULL since no local
mailbox is selected.

Since the APPENDLIMIT isn't expected to change frequently anyways,
simply omit APPENDLIMIT from the STATUS message in these cases.

LBBS-151 #close

Author: InterLinked1

nets/net_imap.c

@@ -1619,16 +1619,20 @@ static void construct_status(struct imap_session *imap, struct imap_traversal *t
 {
 	char *pos = buf;
 	size_t left = len;
-	unsigned int appendlimit;
 
 	SAFE_FAST_COND_APPEND(buf, len, pos, left, strstr(s, "MESSAGES"), "MESSAGES %d", traversal->totalnew + traversal->totalcur);
 	SAFE_FAST_COND_APPEND(buf, len, pos, left, strstr(s, "RECENT"), "RECENT %d", traversal->totalnew);
 	SAFE_FAST_COND_APPEND(buf, len, pos, left, strstr(s, "UIDNEXT"), "UIDNEXT %d", traversal->uidnext + 1);
 	SAFE_FAST_COND_APPEND(buf, len, pos, left, strstr(s, "UIDVALIDITY"), "UIDVALIDITY %d", traversal->uidvalidity);
 	/* Unlike with SELECT, this is the TOTAL number of unseen messages, not merely the first one */
 	SAFE_FAST_COND_APPEND(buf, len, pos, left, strstr(s, "UNSEEN"), "UNSEEN %d", traversal->totalunseen);
-	appendlimit = MIN((unsigned int) mailbox_quota(imap->mbox), max_append_size);
-	SAFE_FAST_COND_APPEND(buf, len, pos, left, strstr(s, "APPENDLIMIT"), "APPENDLIMIT %u", appendlimit);
+	if (imap->mbox) {
+		/* If idling on remote mailbox with NOTIFY enabled, imap->mbox may be NULL at the moment;
+		 * since APPENDLIMIT isn't expected to change frequently anyways, just skip it in these cases.
+		 * In general, depending on the mailbox, this may not even be the right value to use here. */
+		unsigned int appendlimit = MIN((unsigned int) mailbox_quota(imap->mbox), max_append_size);
+		SAFE_FAST_COND_APPEND(buf, len, pos, left, strstr(s, "APPENDLIMIT"), "APPENDLIMIT %u", appendlimit);
+	}
 	SAFE_FAST_COND_APPEND(buf, len, pos, left, strstr(s, "HIGHESTMODSEQ"), "HIGHESTMODSEQ %lu", maxmodseq);
 	/* RFC 8438 STATUS=SIZE extension */
 	SAFE_FAST_COND_APPEND(buf, len, pos, left, strstr(s, "SIZE"), "SIZE %lu", traversal->totalsize);