From: Timo Sirainen Date: Mon, 4 Jan 2016 19:34:01 +0000 (-0500) Subject: imap: Avoid crashing at deinit if mail_user_unref() triggers mail_storage_callbacks X-Git-Tag: 2.2.22.rc1~382 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ddffbb277e212adb9d594b3d7d1e1d39fa78f7c6;p=thirdparty%2Fdovecot%2Fcore.git imap: Avoid crashing at deinit if mail_user_unref() triggers mail_storage_callbacks This could have happened with Maildir/mbox and autoexpunging. --- diff --git a/src/imap/imap-client.c b/src/imap/imap-client.c index 18d9b7d635..1f2138e302 100644 --- a/src/imap/imap-client.c +++ b/src/imap/imap-client.c @@ -385,9 +385,7 @@ static void client_default_destroy(struct client *client, const char *reason) timeout_remove(&client->to_delayed_input); timeout_remove(&client->to_idle); - i_stream_destroy(&client->input); - o_stream_destroy(&client->output); - + /* i/ostreams are already closed at this stage, so fd can be closed */ net_disconnect(client->fd_in); if (client->fd_in != client->fd_out) net_disconnect(client->fd_out); @@ -396,6 +394,11 @@ static void client_default_destroy(struct client *client, const char *reason) some background work like autoexpunging. */ mail_user_unref(&client->user); + /* free the i/ostreams after mail_user_unref(), which could trigger + mail_storage_callbacks notifications that write to the ostream. */ + i_stream_destroy(&client->input); + o_stream_destroy(&client->output); + if (array_is_created(&client->search_saved_uidset)) array_free(&client->search_saved_uidset); if (array_is_created(&client->search_updates))