From: Stephan Bosch <stephan.bosch@open-xchange.com>
Date: Fri, 5 Nov 2021 16:11:49 +0000 (+0100)
Subject: lib-smtp: smtp-server-command - Hold a command reference while sending replies.
X-Git-Tag: 2.3.18~144
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=533ef6c62dae0c43eea57429c587df5fa3f6d61d;p=thirdparty%2Fdovecot%2Fcore.git

lib-smtp: smtp-server-command - Hold a command reference while sending replies.

Fixes segfault at smtp-server-reply.c:652.
---

diff --git a/src/lib-smtp/smtp-server-command.c b/src/lib-smtp/smtp-server-command.c
index d2e75a6832..2cb1c56246 100644
--- a/src/lib-smtp/smtp-server-command.c
+++ b/src/lib-smtp/smtp-server-command.c
@@ -696,6 +696,9 @@ static int
 smtp_server_command_send_more_replies(struct smtp_server_command *cmd)
 {
 	unsigned int i;
+	int ret = 1;
+
+	smtp_server_command_ref(cmd);
 
 	// FIXME: handle LMTP DATA command with enormous number of recipients;
 	// i.e. don't keep filling output stream with replies indefinitely.
@@ -706,13 +709,18 @@ smtp_server_command_send_more_replies(struct smtp_server_command *cmd)
 
 		if (!reply->submitted) {
 			i_assert(!reply->sent);
-			return 0;
+			ret = 0;
+			break;
+		}
+		if (smtp_server_reply_send(reply) < 0) {
+			ret = -1;
+			break;
 		}
-		if (smtp_server_reply_send(reply) < 0)
-			return -1;
 	}
 
-	return 1;
+	if (!smtp_server_command_unref(&cmd))
+		return -1;
+	return ret;
 }
 
 bool smtp_server_command_send_replies(struct smtp_server_command *cmd)