From: Stephan Bosch <stephan@rename-it.nl>
Date: Tue, 30 Sep 2014 20:49:52 +0000 (+0300)
Subject: lib-http: client: The http_client_queue_fail() function aborted requests in an unsafe... 
X-Git-Tag: 2.2.14.rc1~18
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0d30ec5bef193a1fdb4c166c264a2918df37033f;p=thirdparty%2Fdovecot%2Fcore.git

lib-http: client: The http_client_queue_fail() function aborted requests in an unsafe manner.
Copied queues before freeing the requests, because the destroyed requests modify the queue.
---

diff --git a/src/lib-http/http-client-queue.c b/src/lib-http/http-client-queue.c
index 9778fb771a..083be294b3 100644
--- a/src/lib-http/http-client-queue.c
+++ b/src/lib-http/http-client-queue.c
@@ -125,19 +125,26 @@ void http_client_queue_free(struct http_client_queue *queue)
 void http_client_queue_fail(struct http_client_queue *queue,
 	unsigned int status, const char *error)
 {
-	struct http_client_request **req;
+	ARRAY_TYPE(http_client_request) *req_arr, treqs;
+	struct http_client_request **req_idx;
 
 	/* abort all pending requests */
-	array_foreach_modifiable(&queue->request_queue, req) {
-		http_client_request_error(*req, status, error);
+	req_arr = &queue->request_queue;
+	t_array_init(&treqs, array_count(req_arr));
+	array_copy(&treqs.arr, 0, &req_arr->arr, 0, array_count(req_arr));
+	array_foreach_modifiable(&treqs, req_idx) {
+		http_client_request_error(*req_idx, status, error);
 	}
-	array_clear(&queue->request_queue);
+	array_clear(req_arr);
 
 	/* abort all delayed requests */
-	array_foreach_modifiable(&queue->delayed_request_queue, req) {
-		http_client_request_error(*req, status, error);
+	req_arr = &queue->delayed_request_queue;
+	array_clear(&treqs);
+	array_copy(&treqs.arr, 0, &req_arr->arr, 0, array_count(req_arr));
+	array_foreach_modifiable(&treqs, req_idx) {
+		http_client_request_error(*req_idx, status, error);
 	}
-	array_clear(&queue->delayed_request_queue);
+	array_clear(req_arr);
 }
 
 void