From 559530a208f8287d450cd842bfbdda92da97971c Mon Sep 17 00:00:00 2001
From: Craig Jennings <c@cjennings.net>
Date: Sat, 11 Jul 2026 12:51:54 -0500
Subject: fix(custom-buffer-file): stop leaking the MIME handle in the email
 viewer

cj/view-email-in-buffer dissected the message into a handle, then signaled a user-error when it found no displayable part, before the mm-destroy-parts cleanup. The handle leaked on every image-only or attachment-only email. Wrap the body in unwind-protect so the handle is always destroyed.

While here, the eager top-level require of mm-decode only fed the mm-handle-type macro at compile time. The viewer already requires mm-decode at runtime before any mm-* call, so I moved it to eval-when-compile plus declare-function (matching the ps-print block above). Opening Emacs no longer loads mm-decode unless you view an email.
---
 modules/custom-buffer-file.el | 40 +++++++++++++++++++++++++---------------
 1 file changed, 25 insertions(+), 15 deletions(-)

(limited to 'modules/custom-buffer-file.el')

diff --git a/modules/custom-buffer-file.el b/modules/custom-buffer-file.el
index 25555b53..d8e97e27 100644
--- a/modules/custom-buffer-file.el
+++ b/modules/custom-buffer-file.el
@@ -51,8 +51,13 @@
 (declare-function ps-print-buffer-with-faces "ps-print")
 (declare-function ps-print-region-with-faces "ps-print")
 
-;; mm-decode for email viewing (mm-handle-type is a macro, needs early require)
-(require 'mm-decode)
+;; mm-handle-type is a macro used in `cj/--email-handle-is-type-p', so mm-decode
+;; is only needed at compile time here; `cj/view-email-in-buffer' requires it at
+;; runtime before any mm-* call, so the eager startup require is unnecessary.
+(eval-when-compile (require 'mm-decode))
+(declare-function mm-dissect-buffer "mm-decode")
+(declare-function mm-insert-part "mm-decode")
+(declare-function mm-destroy-parts "mm-decode")
 (require 'external-open) ;; for cj/xdg-open, cj/open-this-file-with
 (require 'system-lib)   ;; cj/confirm-strong (overwrite confirms), used below
 
@@ -941,19 +946,24 @@ Signals an error if:
   (let* ((handle (mm-dissect-buffer t))
          (displayable-part (cj/--email-find-displayable-part handle))
          (buffer-name (format "*Email: %s*" (file-name-nondirectory buffer-file-name))))
-    (unless displayable-part
-      (user-error "No displayable content found in email"))
-    (with-current-buffer (get-buffer-create buffer-name)
-      (let ((inhibit-read-only t))
-        (erase-buffer)
-        (mm-insert-part displayable-part)
-        (goto-char (point-min))
-        (when (cj/--email-handle-is-type-p displayable-part "text/html")
-          (shr-render-region (point-min) (point-max)))
-        (goto-char (point-min))
-        (special-mode)))
-    (mm-destroy-parts handle)
-    (switch-to-buffer buffer-name)))
+    ;; `mm-dissect-buffer' allocates handles that must be freed even when we
+    ;; bail out early (no displayable part), so destroy them from the cleanup
+    ;; form rather than after the body.
+    (unwind-protect
+        (progn
+          (unless displayable-part
+            (user-error "No displayable content found in email"))
+          (with-current-buffer (get-buffer-create buffer-name)
+            (let ((inhibit-read-only t))
+              (erase-buffer)
+              (mm-insert-part displayable-part)
+              (goto-char (point-min))
+              (when (cj/--email-handle-is-type-p displayable-part "text/html")
+                (shr-render-region (point-min) (point-max)))
+              (goto-char (point-min))
+              (special-mode)))
+          (switch-to-buffer buffer-name))
+      (mm-destroy-parts handle))))
 
 ;; --------------------------- Buffer And File Keymap --------------------------
 
-- 
cgit v1.2.3