From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Wed, 31 Oct 2018 23:27:50 +0000 (+0100)
Subject: lib-smtp: server: command: Prevent reference counting from within destroy hook.
X-Git-Tag: 2.3.5~60
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=48dba2d135ee195cf2a938d3b58b99066cfbe747;p=thirdparty%2Fdovecot%2Fcore.git

lib-smtp: server: command: Prevent reference counting from within destroy hook.
---

diff --git a/src/lib-smtp/smtp-server-command.c b/src/lib-smtp/smtp-server-command.c
index 1c0e526e46..c673ebc245 100644
--- a/src/lib-smtp/smtp-server-command.c
+++ b/src/lib-smtp/smtp-server-command.c
@@ -243,6 +243,8 @@ smtp_server_command_new(struct smtp_server_connection *conn,
 
 void smtp_server_command_ref(struct smtp_server_command *cmd)
 {
+	if (cmd->destroying)
+		return;
 	cmd->refcount++;
 }
 
@@ -253,9 +255,13 @@ bool smtp_server_command_unref(struct smtp_server_command **_cmd)
 
 	*_cmd = NULL;
 
+	if (cmd->destroying)
+		return FALSE;
+
 	i_assert(cmd->refcount > 0);
 	if (--cmd->refcount > 0)
 		return TRUE;
+	cmd->destroying = TRUE;
 
 	smtp_server_command_debug(&cmd->context, "Destroy");
 
diff --git a/src/lib-smtp/smtp-server-private.h b/src/lib-smtp/smtp-server-private.h
index 3b0c397241..9d9365880b 100644
--- a/src/lib-smtp/smtp-server-private.h
+++ b/src/lib-smtp/smtp-server-private.h
@@ -108,6 +108,7 @@ struct smtp_server_command {
 	bool input_locked:1;
 	bool input_captured:1;
 	bool reply_early:1;
+	bool destroying:1;
 };
 
 struct smtp_server_recipient_private {