From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Tue, 19 Apr 2022 08:40:52 +0000 (+0300)
Subject: auth: Fix crash when user iteration request is queued
X-Git-Tag: 2.3.19~9
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=94577c4450f7fe23896d163fa88645f921a0d7f2;p=thirdparty%2Fdovecot%2Fcore.git

auth: Fix crash when user iteration request is queued

auth_worker_call() returns NULL when the request couldn't be handled
immediately, which would result in NULL pointer dereference later on.
---

diff --git a/src/auth/userdb-blocking.c b/src/auth/userdb-blocking.c
index 0cd2d23502..9f928e740f 100644
--- a/src/auth/userdb-blocking.c
+++ b/src/auth/userdb-blocking.c
@@ -71,11 +71,13 @@ void userdb_blocking_lookup(struct auth_request *request)
 			 str_c(str), user_callback, request);
 }
 
-static bool iter_callback(struct auth_worker_connection *conn ATTR_UNUSED,
+static bool iter_callback(struct auth_worker_connection *conn,
 			  const char *reply, void *context)
 {
 	struct blocking_userdb_iterate_context *ctx = context;
 
+	ctx->conn = conn;
+
 	if (str_begins(reply, "*\t")) {
 		if (ctx->destroyed)
 			return TRUE;
@@ -109,8 +111,8 @@ userdb_blocking_iter_init(struct auth_request *request,
 	ctx->ctx.context = context;
 
 	auth_request_ref(request);
-	ctx->conn = auth_worker_call(request->pool, "*",
-				     str_c(str), iter_callback, ctx);
+	auth_worker_call(request->pool, "*",
+			 str_c(str), iter_callback, ctx);
 	return &ctx->ctx;
 }
 
@@ -119,6 +121,8 @@ void userdb_blocking_iter_next(struct userdb_iterate_context *_ctx)
 	struct blocking_userdb_iterate_context *ctx =
 		(struct blocking_userdb_iterate_context *)_ctx;
 
+	i_assert(ctx->conn != NULL);
+
 	ctx->next = TRUE;
 	auth_worker_server_resume_input(ctx->conn);
 }
@@ -134,6 +138,7 @@ int userdb_blocking_iter_deinit(struct userdb_iterate_context **_ctx)
 	/* iter_callback() may still be called */
 	ctx->destroyed = TRUE;
 
-	auth_worker_server_resume_input(ctx->conn);
+	if (ctx->conn != NULL)
+		auth_worker_server_resume_input(ctx->conn);
 	return ret;
 }