From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Fri, 2 Nov 2018 09:08:26 +0000 (+0100)
Subject: lib-smtp: client: transaction: Hold a reference to the transaction while calling... 
X-Git-Tag: 2.3.5~52
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=03e2a66ad59b9e697e05ddace507e1d10cf0e54f;p=thirdparty%2Fdovecot%2Fcore.git

lib-smtp: client: transaction: Hold a reference to the transaction while calling the RCPT command callback.

This fixes memory problems when the callback inadvertently gets the transaction destroyed.
---

diff --git a/src/lib-smtp/smtp-client-transaction.c b/src/lib-smtp/smtp-client-transaction.c
index f882f43d0b..f3cb974b8d 100644
--- a/src/lib-smtp/smtp-client-transaction.c
+++ b/src/lib-smtp/smtp-client-transaction.c
@@ -802,7 +802,18 @@ smtp_client_transaction_rcpt_cb(const struct smtp_reply *reply,
 	else
 		smtp_client_transaction_rcpt_denied(&rcpt);
 
-	rcpt_callback(reply, context);
+	/* call the callback */
+	{
+		enum smtp_client_transaction_state state;
+		struct smtp_client_transaction *tmp_trans = trans;
+
+		smtp_client_transaction_ref(tmp_trans);
+		rcpt_callback(reply, context);
+		state = trans->state;
+		smtp_client_transaction_unref(&tmp_trans);
+		if (state >= SMTP_CLIENT_TRANSACTION_STATE_FINISHED)
+			return;
+	}
 
 	smtp_client_transaction_try_complete(trans);
 }