]> git.ipfire.org Git - thirdparty/dovecot/core.git/commitdiff
auth: Access always first entry when flushing failures
authorAki Tuomi <aki.tuomi@dovecot.fi>
Mon, 5 Jun 2017 09:14:57 +0000 (12:14 +0300)
committerAki Tuomi <aki.tuomi@dovecot.fi>
Mon, 5 Jun 2017 09:26:29 +0000 (12:26 +0300)
The code is deleting the first item after accessing
it, and then moving forward. It will eventually go
beyond the array and get NULL ptr and fail.

Instead we need to always get the first item,
since the array deletion is moving the queued items
forward.

Broken by e18b4e41

src/auth/auth-request-handler.c

index 2c7468969d68882a121c63b66afdb83d5aa2f093..543c4bf28e9249962314d720be19518b9d835720 100644 (file)
@@ -865,9 +865,10 @@ void auth_request_handler_flush_failures(bool flush_all)
 
        /* flush the requests */
        for (i = 0; i < count; i++) {
-               auth_request = auth_requests[aqueue_idx(auth_failures, i)];
+               auth_request = auth_requests[aqueue_idx(auth_failures, 0)];
                aqueue_delete_tail(auth_failures);
 
+               i_assert(auth_request != NULL);
                i_assert(auth_request->state == AUTH_REQUEST_STATE_FINISHED);
                auth_request_handler_reply(auth_request,
                                           AUTH_CLIENT_RESULT_FAILURE,