From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Wed, 15 Aug 2018 22:28:51 +0000 (+0200)
Subject: lib-smtp: client: Fix segmentation fault occurring at transaction timeout.
X-Git-Tag: 2.3.5~332
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3d932fea914642df544abcd8ace0b64a08cf2219;p=thirdparty%2Fdovecot%2Fcore.git

lib-smtp: client: Fix segmentation fault occurring at transaction timeout.

In the DATA command callback trans->cmd_data can be NULL when the command is
aborted from smtp_client_transaction_fail_reply().
---

diff --git a/src/lib-smtp/smtp-client-transaction.c b/src/lib-smtp/smtp-client-transaction.c
index 95a06eedae..0f486c6b39 100644
--- a/src/lib-smtp/smtp-client-transaction.c
+++ b/src/lib-smtp/smtp-client-transaction.c
@@ -661,7 +661,8 @@ smtp_client_transaction_data_cb(const struct smtp_reply *reply,
 	smtp_client_transaction_ref(trans);
 
 	rcpt = array_get_modifiable(&trans->rcpts, &count);
-	if (trans->rcpt_next_data_idx == 0 && count > 0) 
+	if (trans->cmd_data != NULL && /* NULL when failed early */
+	    trans->rcpt_next_data_idx == 0 && count > 0)
 		smtp_client_command_set_replies(trans->cmd_data, count);
 	for (i = trans->rcpt_next_data_idx; i < count; i++) {
 		trans->rcpt_next_data_idx = i + 1;