imap-urlauth: clients_deinit(): Fix use after free

Found by coverity.

diff --git a/src/imap-urlauth/imap-urlauth-client.c b/src/imap-urlauth/imap-urlauth-client.c
index 6d33122aea69e78449797df5a9920145f12e03ba..30fe87a13fc3fe1ea6756cd176bfc6d0cfcf2b88 100644 (file)
--- a/src/imap-urlauth/imap-urlauth-client.c
+++ b/src/imap-urlauth/imap-urlauth-client.c
@@ -189,10 +189,11 @@ void clients_init(void)
 
 void clients_deinit(void)
 {
-       struct connection *conn;
+       struct connection *conn, *next;
+
+       for (conn = imap_urlauth_clist->connections; conn != NULL; conn = next) {
+               next = conn->next; /* client_destroy() frees client & conn */
 
-       for (conn = imap_urlauth_clist->connections;
-            conn != NULL; conn = conn->next) {
                struct client *client = container_of(conn, struct client, conn);
 
                client_destroy(client, MASTER_SERVICE_SHUTTING_DOWN_MSG);