]> git.ipfire.org Git - thirdparty/dovecot/core.git/commitdiff
fs-api: Retrieve errno before dest->copy_output is NULL'ed
authorAki Tuomi <aki.tuomi@dovecot.fi>
Mon, 5 Sep 2016 09:42:08 +0000 (12:42 +0300)
committerAki Tuomi <aki.tuomi@dovecot.fi>
Wed, 7 Sep 2016 09:18:59 +0000 (12:18 +0300)
CID 10144: When aborting output, errno retrieval
is attempted after dest->copy_output has already
been unreffed. Found by coverity.

src/lib-fs/fs-api.c

index b580a029f8199c5e87c5e1190cbb71fdde53afec..062b492403976554f59130e497aa9f59bb0baf7c 100644 (file)
@@ -892,6 +892,7 @@ int fs_get_nlinks(struct fs_file *file, nlink_t *nlinks_r)
 
 int fs_default_copy(struct fs_file *src, struct fs_file *dest)
 {
+       int tmp_errno;
        /* we're going to be counting this as read+write, so remove the
           copy_count we just added */
        dest->fs->stats.copy_count--;
@@ -926,11 +927,13 @@ int fs_default_copy(struct fs_file *src, struct fs_file *dest)
                i_stream_unref(&dest->copy_input);
                return -1;
        case OSTREAM_SEND_ISTREAM_RESULT_ERROR_OUTPUT:
+               /* errno might not survive abort error */
+               tmp_errno = dest->copy_output->stream_errno;
                fs_write_stream_abort_error(dest, &dest->copy_output,
                                            "write(%s) failed: %s",
                                            o_stream_get_name(dest->copy_output),
                                            o_stream_get_error(dest->copy_output));
-               errno = dest->copy_output->stream_errno;
+               errno = tmp_errno;
                i_stream_unref(&dest->copy_input);
                return -1;
        }