From: Stephan Bosch <stephan.bosch@dovecot.fi>
Date: Sat, 17 Feb 2018 14:17:06 +0000 (+0100)
Subject: lib-http: client: Hold reference to the connection while continuing request payload.
X-Git-Tag: 2.3.1~116
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e1c3c710723fa3fe8f254ab5ffe2f04067cbec15;p=thirdparty%2Fdovecot%2Fcore.git

lib-http: client: Hold reference to the connection while continuing request payload.

Subsequent changes may cause the connection to be destroyed while sending.
---

diff --git a/src/lib-http/http-client-connection.c b/src/lib-http/http-client-connection.c
index 232872d9fb..41f331e2dd 100644
--- a/src/lib-http/http-client-connection.c
+++ b/src/lib-http/http-client-connection.c
@@ -1192,10 +1192,12 @@ static void http_client_connection_input(struct connection *_conn)
 static int
 http_client_connection_continue_request(struct http_client_connection *conn)
 {
+	struct http_client_connection *tmp_conn;
 	struct http_client_request *const *reqs;
 	unsigned int count;
 	struct http_client_request *req;
 	bool pipelined;
+	int ret;
 
 	reqs = array_get(&conn->request_wait_list, &count);
 	if (count == 0 || !conn->output_locked)
@@ -1219,7 +1221,10 @@ http_client_connection_continue_request(struct http_client_connection *conn)
 	if (req->payload_sync && !req->payload_sync_continue)
 		return 0;
 
-	if (http_client_request_send_more(req, pipelined) < 0)
+	tmp_conn = conn;
+	http_client_connection_ref(tmp_conn);
+	ret = http_client_request_send_more(req, pipelined);
+	if (!http_client_connection_unref(&tmp_conn) || ret < 0)
 		return -1;
 
 	if (!conn->output_locked) {