From: Aki Tuomi <aki.tuomi@dovecot.fi>
Date: Mon, 5 Sep 2016 09:42:08 +0000 (+0300)
Subject: fs-api: Retrieve errno before dest->copy_output is NULL'ed
X-Git-Tag: 2.2.26~299
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b3a37312811259fe6d8da7189016a370759a3cdc;p=thirdparty%2Fdovecot%2Fcore.git

fs-api: Retrieve errno before dest->copy_output is NULL'ed

CID 10144: When aborting output, errno retrieval
is attempted after dest->copy_output has already
been unreffed. Found by coverity.
---

diff --git a/src/lib-fs/fs-api.c b/src/lib-fs/fs-api.c
index d677c840a9..1d21758475 100644
--- a/src/lib-fs/fs-api.c
+++ b/src/lib-fs/fs-api.c
@@ -888,6 +888,7 @@ int fs_get_nlinks(struct fs_file *file, nlink_t *nlinks_r)
 
 int fs_default_copy(struct fs_file *src, struct fs_file *dest)
 {
+	int tmp_errno;
 	/* we're going to be counting this as read+write, so remove the
 	   copy_count we just added */
 	dest->fs->stats.copy_count--;
@@ -917,11 +918,13 @@ int fs_default_copy(struct fs_file *src, struct fs_file *dest)
 		return -1;
 	}
 	if (dest->copy_output->stream_errno != 0) {
+		/* errno might not survive abort error */
+		tmp_errno = dest->copy_output->stream_errno;
 		fs_write_stream_abort_error(dest, &dest->copy_output,
 					    "write(%s) failed: %s",
 					    o_stream_get_name(dest->copy_output),
 					    o_stream_get_error(dest->copy_output));
-		errno = dest->copy_output->stream_errno;
+		errno = tmp_errno;
 		i_stream_unref(&dest->copy_input);
 		return -1;
 	}