From: Stephan Bosch <stephan@rename-it.nl>
Date: Mon, 8 Feb 2016 21:55:09 +0000 (+0100)
Subject: lib-http: server: Make sure that any pending request is aborted and destroyed before... 
X-Git-Tag: 2.2.22.rc1~188
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=489fb497f3fd57b61a472c6782913eae76586a7e;p=thirdparty%2Fdovecot%2Fcore.git

lib-http: server: Make sure that any pending request is aborted and destroyed before connection FDs are closed.

This way, any payload io struct created from the request callback can be
freed before the associated FD becomes invalid. This would cause an assert
failure otherwise.
---

diff --git a/src/lib-http/http-server-connection.c b/src/lib-http/http-server-connection.c
index c183f3fe2e..2e9a56ad79 100644
--- a/src/lib-http/http-server-connection.c
+++ b/src/lib-http/http-server-connection.c
@@ -861,6 +861,8 @@ static void
 http_server_connection_disconnect(struct http_server_connection *conn,
 	const char *reason)
 {
+	struct http_server_request *req, *req_next;
+
 	if (conn->closed)
 		return;
 
@@ -873,6 +875,14 @@ http_server_connection_disconnect(struct http_server_connection *conn,
 	/* preserve statistics */
 	http_server_connection_update_stats(conn);
 
+	/* drop all requests before connection is closed */
+	req = conn->request_queue_head;
+	while (req != NULL) {
+		req_next = req->next;
+		http_server_request_abort(&req);
+		req = req_next;
+	}
+
 	if (conn->to_input != NULL)
 		timeout_remove(&conn->to_input);
 
@@ -899,7 +909,6 @@ http_server_connection_disconnect(struct http_server_connection *conn,
 void http_server_connection_unref(struct http_server_connection **_conn)
 {
 	struct http_server_connection *conn = *_conn;
-	struct http_server_request *req, *req_next;
 
 	i_assert(conn->refcount > 0);
 	if (--conn->refcount > 0)
@@ -909,13 +918,6 @@ void http_server_connection_unref(struct http_server_connection **_conn)
 
 	http_server_connection_debug(conn, "Connection destroy");
 
-	req = conn->request_queue_head;
-	while (req != NULL) {
-		req_next = req->next;
-		http_server_request_abort(&req);
-		req = req_next;
-	}
-
 	if (conn->ssl_iostream != NULL)
 		ssl_iostream_unref(&conn->ssl_iostream);
 	connection_deinit(&conn->conn);