imap: Avoid crashing at deinit if mail_user_unref() triggers mail_storage_callbacks

This could have happened with Maildir/mbox and autoexpunging.

diff --git a/src/imap/imap-client.c b/src/imap/imap-client.c
index 18d9b7d6356ac0442ff8c65d5da99e6857b9b708..1f2138e302d3db7ee1eaa5f60f1db7f7b311b8df 100644 (file)
--- a/src/imap/imap-client.c
+++ b/src/imap/imap-client.c
@@ -385,9 +385,7 @@ static void client_default_destroy(struct client *client, const char *reason)
                timeout_remove(&client->to_delayed_input);
        timeout_remove(&client->to_idle);
 
-       i_stream_destroy(&client->input);
-       o_stream_destroy(&client->output);
-
+       /* i/ostreams are already closed at this stage, so fd can be closed */
        net_disconnect(client->fd_in);
        if (client->fd_in != client->fd_out)
                net_disconnect(client->fd_out);
@@ -396,6 +394,11 @@ static void client_default_destroy(struct client *client, const char *reason)
           some background work like autoexpunging. */
        mail_user_unref(&client->user);
 
+       /* free the i/ostreams after mail_user_unref(), which could trigger
+          mail_storage_callbacks notifications that write to the ostream. */
+       i_stream_destroy(&client->input);
+       o_stream_destroy(&client->output);
+
        if (array_is_created(&client->search_saved_uidset))
                array_free(&client->search_saved_uidset);
        if (array_is_created(&client->search_updates))