The NULL return here is not API breaking, since the NULL from
_string_map_create could previously be returned.
---
 lib/message-private.h   |  4 ++--
 lib/message-property.cc | 17 +++++++++++++++--
 lib/message.cc          | 28 ++++++++++++++++++++--------
 lib/notmuch.h           |  6 ++++--
 4 files changed, 41 insertions(+), 14 deletions(-)

diff --git a/lib/message-private.h b/lib/message-private.h
index 74199256..2cfc95a7 100644
--- a/lib/message-private.h
+++ b/lib/message-private.h
@@ -1,8 +1,8 @@
 #ifndef MESSAGE_PRIVATE_H
 #define MESSAGE_PRIVATE_H
 
-notmuch_string_map_t *
-_notmuch_message_property_map (notmuch_message_t *message);
+notmuch_private_status_t
+_notmuch_message_property_map (notmuch_message_t *message, notmuch_string_map_t **map);
 
 notmuch_bool_t
 _notmuch_message_frozen (notmuch_message_t *message);
diff --git a/lib/message-property.cc b/lib/message-property.cc
index 0b13cac3..e81843d3 100644
--- a/lib/message-property.cc
+++ b/lib/message-property.cc
@@ -28,10 +28,18 @@
 notmuch_status_t
 notmuch_message_get_property (notmuch_message_t *message, const char *key, const char **value)
 {
+    notmuch_private_status_t private_status;
+    notmuch_string_map_t *map;
+
     if (! value)
 	return NOTMUCH_STATUS_NULL_POINTER;
 
-    *value = _notmuch_string_map_get (_notmuch_message_property_map (message), key);
+    private_status = _notmuch_message_property_map (message, &map);
+    if (private_status)
+	return COERCE_STATUS (private_status,
+			      "Unhandled error reading message property");
+
+    *value = _notmuch_string_map_get (map, key);
 
     return NOTMUCH_STATUS_SUCCESS;
 }
@@ -110,8 +118,13 @@ notmuch_message_remove_all_properties (notmuch_message_t *message, const char *k
 notmuch_message_properties_t *
 notmuch_message_get_properties (notmuch_message_t *message, const char *key, notmuch_bool_t exact)
 {
+    notmuch_private_status_t private_status;
     notmuch_string_map_t *map;
-    map = _notmuch_message_property_map (message);
+
+    private_status = _notmuch_message_property_map (message, &map);
+    if (private_status)
+	return NULL;
+
     return _notmuch_string_map_iterator_create (map, key, exact);
 }
 
diff --git a/lib/message.cc b/lib/message.cc
index 80fbd5ab..9ba24e8c 100644
--- a/lib/message.cc
+++ b/lib/message.cc
@@ -1823,16 +1823,19 @@ _notmuch_message_database (notmuch_message_t *message)
     return message->notmuch;
 }
 
-static void
+static notmuch_private_status_t
 _notmuch_message_ensure_property_map (notmuch_message_t *message)
 {
     notmuch_string_node_t *node;
 
     if (message->property_map)
-	return;
+	return NOTMUCH_PRIVATE_STATUS_SUCCESS;
 
-    if (!message->property_term_list)
-	_notmuch_message_ensure_metadata (message);
+    if (!message->property_term_list) {
+	notmuch_private_status_t status = _notmuch_message_ensure_metadata (message);
+	if (status)
+	    return status;
+    }
 
     message->property_map = _notmuch_string_map_create (message);
 
@@ -1854,14 +1857,23 @@ _notmuch_message_ensure_property_map (notmuch_message_t *message)
 
     talloc_free (message->property_term_list);
     message->property_term_list = NULL;
+    return NOTMUCH_PRIVATE_STATUS_SUCCESS;
 }
 
-notmuch_string_map_t *
-_notmuch_message_property_map (notmuch_message_t *message)
+notmuch_private_status_t
+_notmuch_message_property_map (notmuch_message_t *message, notmuch_string_map_t **map)
 {
-    _notmuch_message_ensure_property_map (message);
+    notmuch_private_status_t status;
+
+    if (!map)
+	return NOTMUCH_PRIVATE_STATUS_NULL_POINTER;
 
-    return message->property_map;
+    status = _notmuch_message_ensure_property_map (message);
+    if (status)
+	return status;
+
+    *map = message->property_map;
+    return NOTMUCH_PRIVATE_STATUS_SUCCESS;
 }
 
 notmuch_bool_t
diff --git a/lib/notmuch.h b/lib/notmuch.h
index 4e25958c..2e8ccb05 100644
--- a/lib/notmuch.h
+++ b/lib/notmuch.h
@@ -1753,7 +1753,7 @@ typedef struct _notmuch_string_map_iterator notmuch_message_properties_t;
  *     notmuch_message_properties_t *list;
  *
  *     for (list = notmuch_message_get_properties (message, "testkey1", TRUE);
- *          notmuch_message_properties_valid (list); notmuch_message_properties_move_to_next (list)) {
+ *          list && notmuch_message_properties_valid (list); notmuch_message_properties_move_to_next (list)) {
  *        printf("%s\n", notmuch_message_properties_value(list));
  *     }
  *
@@ -1761,9 +1761,11 @@ typedef struct _notmuch_string_map_iterator notmuch_message_properties_t;
  *
  * Note that there's no explicit destructor needed for the
  * notmuch_message_properties_t object. (For consistency, we do
- * provide a notmuch_message_properities_destroy function, but there's
+ * provide a notmuch_message_properties_destroy function, but there's
  * no good reason to call it if the message is about to be destroyed).
  *
+ * @return The function returns NULL on error
+ *
  * @since libnotmuch 4.4 (notmuch 0.23)
  */
 notmuch_message_properties_t *
-- 
2.11.0