From: Timo Sirainen <tss@iki.fi>
Date: Thu, 22 Oct 2015 13:59:01 +0000 (+0300)
Subject: notify plugin: Don't access already freed memory.
X-Git-Tag: 2.2.20.rc1~122
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2f564433c979a41ade84b75fa10c7b46fb9781ac;p=thirdparty%2Fdovecot%2Fcore.git

notify plugin: Don't access already freed memory.
In the same changeset I even added a comment just above that it shouldn't be
accessed..
---

diff --git a/src/plugins/notify/notify-storage.c b/src/plugins/notify/notify-storage.c
index 22175e1e76..eb0b8b24a3 100644
--- a/src/plugins/notify/notify-storage.c
+++ b/src/plugins/notify/notify-storage.c
@@ -178,6 +178,7 @@ notify_transaction_commit(struct mailbox_transaction_context *t,
 {
 	struct notify_transaction_context *lt = NOTIFY_CONTEXT(t);
 	union mailbox_module_context *lbox = NOTIFY_CONTEXT(t->box);
+	bool no_notify = (t->flags & MAILBOX_TRANSACTION_FLAG_NO_NOTIFY) != 0;
 
 	if (lt->tmp_mail != NULL)
 		mail_free(&lt->tmp_mail);
@@ -190,7 +191,7 @@ notify_transaction_commit(struct mailbox_transaction_context *t,
 
 	/* FIXME: note that t is already freed at this stage. it's not actually
 	   being dereferenced anymore though. still, a bit unsafe.. */
-	if ((t->flags & MAILBOX_TRANSACTION_FLAG_NO_NOTIFY) == 0)
+	if (!no_notify)
 		notify_contexts_mail_transaction_commit(t, changes_r);
 	return 0;
 }