b11939: adding fix as recommended by bug reporter along with a couple extra lines to ensure freed pointers are set to NULL.

libclamav/mbox.c

@@ -2365,7 +2365,7 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re
 				 * bother saving to scan, it's safe
 				 */
 				saveIt = (bool)(encodingLine(mainMessage) != NULL);
-			else if((t_line = encodingLine(mainMessage)) != NULL) {
+			else if(mainMessage->body_last != NULL && (t_line = encodingLine(mainMessage)) != NULL) {
 				/*
 				 * Some bounces include the message
 				 * body without the headers.

libclamav/message.c

@@ -1075,8 +1075,10 @@ messageMoveText(message *m, text *t, message *old_message)
 			for(u = old_message->body_first; u != t;) {
 				text *next;
 
-				if(u->t_line)
+				if(u->t_line) {
 					lineUnlink(u->t_line);
+					u->t_line = NULL;
+				}
 				next = u->t_next;
 
 				free(u);

libclamav/text.c

@@ -124,8 +124,10 @@ textDestroy(text *t_head)
 {
 	while(t_head) {
 		text *t_next = t_head->t_next;
-		if(t_head->t_line)
-			(void)lineUnlink(t_head->t_line);
+		if(t_head->t_line) {
+			lineUnlink(t_head->t_line);
+			t_head->t_line = NULL;
+		}
 		free(t_head);
 		t_head = t_next;
 	}
@@ -152,6 +154,8 @@ textCopy(const text *t_head)
 			return NULL;
 		}
 
+		last->t_next = NULL;
+
 		if(t_head->t_line)
 			last->t_line = lineLink(t_head->t_line);
 		else