From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Wed, 31 Oct 2018 23:58:47 +0000 (+0100)
Subject: lib-smtp: server: recipient: Prevent reference counting from within destroy hook.
X-Git-Tag: 2.3.9~1104
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=529eb8a5f118d54250055000afb237c6bd2afd75;p=thirdparty%2Fdovecot%2Fcore.git

lib-smtp: server: recipient: Prevent reference counting from within destroy hook.
---

diff --git a/src/lib-smtp/smtp-server-private.h b/src/lib-smtp/smtp-server-private.h
index 8181a41fb8..da4a090f9b 100644
--- a/src/lib-smtp/smtp-server-private.h
+++ b/src/lib-smtp/smtp-server-private.h
@@ -116,6 +116,8 @@ struct smtp_server_recipient_private {
 	int refcount;
 
 	struct smtp_server_recipient_hook *hooks_head, *hooks_tail;
+
+	bool destroying:1;
 };
 
 struct smtp_server_state_data {
diff --git a/src/lib-smtp/smtp-server-recipient.c b/src/lib-smtp/smtp-server-recipient.c
index 76080149d3..24a752c85c 100644
--- a/src/lib-smtp/smtp-server-recipient.c
+++ b/src/lib-smtp/smtp-server-recipient.c
@@ -33,6 +33,8 @@ void smtp_server_recipient_ref(struct smtp_server_recipient *rcpt)
 	struct smtp_server_recipient_private *prcpt =
 		(struct smtp_server_recipient_private *)rcpt;
 
+	if (prcpt->destroying)
+		return;
 	i_assert(prcpt->refcount > 0);
 	prcpt->refcount++;
 }
@@ -47,10 +49,13 @@ bool smtp_server_recipient_unref(struct smtp_server_recipient **_rcpt)
 
 	if (rcpt == NULL)
 		return FALSE;
+	if (prcpt->destroying)
+		return FALSE;
 
 	i_assert(prcpt->refcount > 0);
 	if (--prcpt->refcount > 0)
 		return TRUE;
+	prcpt->destroying = TRUE;
 
 	smtp_server_recipient_call_hooks(
 		rcpt, SMTP_SERVER_RECIPIENT_HOOK_DESTROY);