Bugfixes.

* mailbox/mime.c (mu_mime_get_num_parts): Assume MIME message
is not scanned if nmtp_parts are 0 and boundary is NULL.
* mailbox/rfc2047.c (mu_rfc2047_decode): Free the buffer prior
to returning a non-zero status.
* mailbox/message.c (mu_message_destroy): Install a kludge
to work over the slopy ref semantics.
* mailbox/auth.c (mu_authority_destroy): Free auth_methods
list.
* mailbox/locker.c (destroy_dotlock): Free data.dot.nfslock.

@@ -69,6 +69,7 @@ mu_authority_destroy (mu_authority_t *pauthority, void *owner)
       if (authority->owner == owner)
 	{
 	  mu_ticket_destroy (&authority->ticket);
+	  mu_list_destroy (&authority->auth_methods);
 	  free (authority);
 	}
       *pauthority = NULL;

@@ -701,6 +701,7 @@ static void
 destroy_dotlock (mu_locker_t locker)
 {
   free (locker->data.dot.dotlock);
+  free (locker->data.dot.nfslock);
 }
 
 #ifndef MAXHOSTNAMELEN
@@ -721,7 +722,7 @@ lock_dotlock (mu_locker_t locker, enum mu_locker_mode mode)
     {
       unlink (locker->data.dot.nfslock);
       free (locker->data.dot.nfslock);
-      locker->data.dot.nfslock = 0;
+      locker->data.dot.nfslock = NULL;
     }
 
   expire_stale_lock (locker);

@@ -105,7 +105,18 @@ mu_message_destroy (mu_message_t *pmsg, void *owner)
       int destroy_lock = 0;
 
       mu_monitor_wrlock (monitor);
-      msg->ref--;
+      /* Note: msg->ref may be incremented by mu_message_ref without
+	 additional checking for its owner, therefore decrementing
+	 it must also occur independently of the owner checking. Due
+	 to this inconsistency ref may reach negative values, which
+	 is very unfortunate.
+
+	 The `owner' stuff is a leftover from older mailutils versions.
+	 There is an ongoing attempt to remove it in the stream-cleanup
+	 branch. When it is ready, it will be merged to the HEAD and this
+	 will finally resolve this issue. */
+      if (msg->ref > 0)
+	msg->ref--;
       if ((msg->owner && msg->owner == owner)
 	  || (msg->owner == NULL && msg->ref <= 0))
 	{
@@ -155,8 +166,8 @@ mu_message_destroy (mu_message_t *pmsg, void *owner)
 	     if (msg->floating_mailbox && msg->mailbox)
 	     mu_mailbox_destroy (&(msg->mailbox));
 	  */
-
-	  if (msg->ref == 0)
+	  
+	  if (msg->ref <= 0)
 	    free (msg);
 	}
       mu_monitor_unlock (monitor);

@@ -930,7 +930,8 @@ mu_mime_get_num_parts (mu_mime_t mime, size_t *nmtp_parts)
 {
   int             ret = 0;
 
-  if (mime->nmtp_parts == 0 || mime->flags & MIME_PARSER_ACTIVE)
+  if ((mime->nmtp_parts == 0 && !mime->boundary)
+      || mime->flags & MIME_PARSER_ACTIVE)
     {
       if (mu_mime_is_multipart (mime))
 	{

@@ -224,8 +224,11 @@ mu_rfc2047_decode (const char *tocode, const char *input, char **ptostr)
   free (fromcode);
   free (encoding_type);
   free (encoded_text);
-  
-  *ptostr = realloc (buffer, bufpos);
+
+  if (status)
+    free (buffer);
+  else
+    *ptostr = realloc (buffer, bufpos);
   return status;
 }