]> git.ipfire.org Git - thirdparty/dovecot/core.git/commitdiff
auth: Access always first entry when flushing failures
authorAki Tuomi <aki.tuomi@dovecot.fi>
Mon, 5 Jun 2017 09:14:57 +0000 (12:14 +0300)
committerVille Savolainen <ville.savolainen@dovecot.fi>
Tue, 6 Jun 2017 12:22:20 +0000 (15:22 +0300)
The code is deleting the first item after accessing
it, and then moving forward. It will eventually go
beyond the array and get NULL ptr and fail.

Instead we need to always get the first item,
since the array deletion is moving the queued items
forward.

Broken by e18b4e41

src/auth/auth-request-handler.c

index 83bf56e4545a887dec6b11b48106d5f2e3784001..83a0829d0373433bb887d01a7f0711303948efb5 100644 (file)
@@ -843,9 +843,10 @@ void auth_request_handler_flush_failures(bool flush_all)
 
        /* flush the requests */
        for (i = 0; i < count; i++) {
-               auth_request = auth_requests[aqueue_idx(auth_failures, i)];
+               auth_request = auth_requests[aqueue_idx(auth_failures, 0)];
                aqueue_delete_tail(auth_failures);
 
+               i_assert(auth_request != NULL);
                i_assert(auth_request->state == AUTH_REQUEST_STATE_FINISHED);
                auth_request_handler_reply(auth_request,
                                           AUTH_CLIENT_RESULT_FAILURE,