lib-http: Don't crash if request callback manages to get the connection destroyed.

diff --git a/src/lib-http/http-client-connection.c b/src/lib-http/http-client-connection.c
index d4bc06590c5c4641ea854e1a92fe7846093fae43..61d0713728bc831e0f9ee6d247c2c4c295d16df3 100644 (file)
--- a/src/lib-http/http-client-connection.c
+++ b/src/lib-http/http-client-connection.c
@@ -373,6 +373,7 @@ http_client_connection_return_response(struct http_client_connection *conn,
        struct http_client_request *req, struct http_response *response)
 {
        struct istream *payload;
+       bool retrying;
 
        i_assert(conn->incoming_payload == NULL);
        i_assert(conn->pending_request == NULL);
@@ -392,7 +393,17 @@ http_client_connection_return_response(struct http_client_connection *conn,
                io_remove(&conn->conn.io);
        }
 
-       if (!http_client_request_callback(req, response)) {
+       http_client_connection_ref(conn);
+       retrying = !http_client_request_callback(req, response);
+       http_client_connection_unref(&conn);
+       if (conn == NULL) {
+               /* the callback managed to get this connection destroyed */
+               if (!retrying)
+                       http_client_request_finish(&req);
+               return FALSE;
+       }
+
+       if (retrying) {
                /* retrying, don't destroy the request */
                if (response->payload != NULL) {
                        i_stream_unset_destroy_callback(conn->incoming_payload);
@@ -404,8 +415,6 @@ http_client_connection_return_response(struct http_client_connection *conn,
                return TRUE;
        }
 
-       // FIXME: conn may be freed at this point..
-
        if (response->payload != NULL) {
                req->state = HTTP_REQUEST_STATE_PAYLOAD_IN;
                payload = response->payload;