The object where pointer to `data` was received was deleted before it was used in _notmuch_string_list_append(). Relevant Coverity messages follow: 3: extract Assigning: data = std::__cxx11::string(message->doc.()).c_str(), which extracts wrapped state from temporary of type std::__cxx11::string. 4: dtor_free The internal representation of temporary of type std::__cxx11::string is freed by its destructor. 5: use after free: Wrapper object use after free (WRAPPER_ESCAPE) Using internal representation of destroyed object local data. --- There were 30+ other 'defects' found, but none of the other seems dangerous (and very few are kinda false). I forked github repo of notmuch and tried this free oss coverity service -- they were surprisingly quick to grant me access to the defects... lib/message.cc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/message.cc b/lib/message.cc index e08659e5d96a..cb313326270e 100644 --- a/lib/message.cc +++ b/lib/message.cc @@ -870,9 +870,9 @@ _notmuch_message_ensure_filename_list (notmuch_message_t *message) * * It would be nice to do the upgrade of the document directly * here, but the database is likely open in read-only mode. */ - const char *data; - data = message->doc.get_data ().c_str (); + std::string datastr = message->doc.get_data (); + const char *data = datastr.c_str (); if (data == NULL) INTERNAL_ERROR ("message with no filename"); -- 2.11.0