imap: Memory leak fixes for invalid parameter handling.

diff --git a/src/imap/cmd-copy.c b/src/imap/cmd-copy.c
index 01be07f0559b8f3f270022bf34cee3208b042904..591e8ee32e092bde5ff32a89c1461d3bd8544f56 100644 (file)
--- a/src/imap/cmd-copy.c
+++ b/src/imap/cmd-copy.c
@@ -106,8 +106,10 @@ bool cmd_copy(struct client_command_context *cmd)
        if (ret <= 0)
                return ret < 0;
 
-       if (client_open_save_dest_box(cmd, mailbox, &destbox) < 0)
+       if (client_open_save_dest_box(cmd, mailbox, &destbox) < 0) {
+               mail_search_args_unref(&search_args);
                return TRUE;
+       }
 
        t = mailbox_transaction_begin(destbox,
                                      MAILBOX_TRANSACTION_FLAG_EXTERNAL |

diff --git a/src/imap/cmd-expunge.c b/src/imap/cmd-expunge.c
index ab4658e93a4ca43c0dd139396e4eb23902de2f7d..4271fd713d19f37e3b7577c8e496aa2242427539 100644 (file)
--- a/src/imap/cmd-expunge.c
+++ b/src/imap/cmd-expunge.c
@@ -23,15 +23,17 @@ static bool cmd_expunge_finish(struct client_command_context *cmd,
                               struct mail_search_args *search_args)
 {
        struct client *client = cmd->client;
+       int ret;
 
-       if (imap_expunge(client->mailbox, search_args == NULL ? NULL :
-                        search_args->args) < 0) {
+       ret = imap_expunge(client->mailbox, search_args == NULL ? NULL :
+                          search_args->args);
+       if (search_args != NULL)
+               mail_search_args_unref(&search_args);
+       if (ret < 0) {
                client_send_storage_error(cmd,
                                          mailbox_get_storage(client->mailbox));
                return TRUE;
        }
-       if (search_args != NULL)
-               mail_search_args_unref(&search_args);
 
        client->sync_seen_deletes = FALSE;
        client->sync_seen_expunges = FALSE;

diff --git a/src/imap/cmd-store.c b/src/imap/cmd-store.c
index c136803e08ad97156d453cd19ff0bbfcfb2ad727..488cb8f644cca0093029d8a96aa157143f0b76e0 100644 (file)
--- a/src/imap/cmd-store.c
+++ b/src/imap/cmd-store.c
@@ -149,10 +149,13 @@ bool cmd_store(struct client_command_context *cmd)
 
        memset(&ctx, 0, sizeof(ctx));
        ctx.cmd = cmd;
-       if (!store_parse_args(&ctx, ++args))
+       if (!store_parse_args(&ctx, ++args)) {
+               mail_search_args_unref(&search_args);
                return TRUE;
+       }
 
        if (client->mailbox_examined) {
+               mail_search_args_unref(&search_args);
                if (ctx.max_modseq < (uint64_t)-1)
                        reply = "NO CONDSTORE failed: Mailbox is read-only.";
                else

diff --git a/src/imap/imap-search-args.c b/src/imap/imap-search-args.c
index dfa2943f701338045e60041da7f30cdcdaaea128..6e469d49f8e003b33c877dfc0274c36a058725e4 100644 (file)
--- a/src/imap/imap-search-args.c
+++ b/src/imap/imap-search-args.c
@@ -117,6 +117,7 @@ static int imap_search_get_msgset_arg(struct client_command_context *cmd,
            !msgset_is_valid(&args->args->value.seqset,
                             cmd->client->messages_count)) {
                *error_r = "Invalid messageset";
+               mail_search_args_unref(&args);
                return -1;
        }
        *args_r = args;
@@ -135,6 +136,7 @@ imap_search_get_uidset_arg(const char *uidset, struct mail_search_args **args_r,
        p_array_init(&args->args->value.seqset, args->pool, 16);
        if (imap_seq_set_parse(uidset, &args->args->value.seqset) < 0) {
                *error_r = "Invalid uidset";
+               mail_search_args_unref(&args);
                return -1;
        }