From: Aki Tuomi <aki.tuomi@dovecot.fi>
Date: Mon, 5 Sep 2016 09:42:08 +0000 (+0300)
Subject: fs-api: Retrieve errno before dest->copy_output is NULL'ed
X-Git-Tag: 2.3.0.rc1~3074
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fdef08644ba66b9db8fe4fc041ecc31a1ec9524b;p=thirdparty%2Fdovecot%2Fcore.git

fs-api: Retrieve errno before dest->copy_output is NULL'ed

CID 10144: When aborting output, errno retrieval
is attempted after dest->copy_output has already
been unreffed. Found by coverity.
---

diff --git a/src/lib-fs/fs-api.c b/src/lib-fs/fs-api.c
index b580a029f8..062b492403 100644
--- a/src/lib-fs/fs-api.c
+++ b/src/lib-fs/fs-api.c
@@ -892,6 +892,7 @@ int fs_get_nlinks(struct fs_file *file, nlink_t *nlinks_r)
 
 int fs_default_copy(struct fs_file *src, struct fs_file *dest)
 {
+	int tmp_errno;
 	/* we're going to be counting this as read+write, so remove the
 	   copy_count we just added */
 	dest->fs->stats.copy_count--;
@@ -926,11 +927,13 @@ int fs_default_copy(struct fs_file *src, struct fs_file *dest)
 		i_stream_unref(&dest->copy_input);
 		return -1;
 	case OSTREAM_SEND_ISTREAM_RESULT_ERROR_OUTPUT:
+		/* errno might not survive abort error */
+		tmp_errno = dest->copy_output->stream_errno;
 		fs_write_stream_abort_error(dest, &dest->copy_output,
 					    "write(%s) failed: %s",
 					    o_stream_get_name(dest->copy_output),
 					    o_stream_get_error(dest->copy_output));
-		errno = dest->copy_output->stream_errno;
+		errno = tmp_errno;
 		i_stream_unref(&dest->copy_input);
 		return -1;
 	}