lib-storage: Fixed crash if mailbox_save_cancel() was called in save_finish()/copy...

diff --git a/src/lib-storage/mail-storage-private.h b/src/lib-storage/mail-storage-private.h
index 6d3c2c10cb74e35ce0e8f55d7e6e8ed04db9fd03..c605af2c1a90fd5da6d46ff3b37936fd37cffb69 100644 (file)
--- a/src/lib-storage/mail-storage-private.h
+++ b/src/lib-storage/mail-storage-private.h
@@ -559,6 +559,8 @@ struct mail_save_context {
        /* mailbox_save_alloc() called, but finish/cancel not.
           the same context is usually returned by the backends for reuse. */
        unsigned int unfinished:1;
+       /* mailbox_save_finish() or mailbox_copy() is being called. */
+       unsigned int finishing:1;
        /* mail was copied using saving */
        unsigned int copying_via_save:1;
        /* mail is being saved, not copied */

diff --git a/src/lib-storage/mail-storage.c b/src/lib-storage/mail-storage.c
index f7d2fc9402b2dd5822bd9c3208144cbaa6ed4eb2..d7b43bc70a4156841bb1326b08161213f172efbc 100644 (file)
--- a/src/lib-storage/mail-storage.c
+++ b/src/lib-storage/mail-storage.c
@@ -2081,7 +2081,10 @@ int mailbox_save_finish(struct mail_save_context **_ctx)
        }
        *_ctx = NULL;
 
+       ctx->finishing = TRUE;
        ret = t->box->v.save_finish(ctx);
+       ctx->finishing = FALSE;
+
        if (ret == 0 && !copying_via_save) {
                if (pvt_flags != 0)
                        mailbox_save_add_pvt_flags(t, pvt_flags);
@@ -2102,7 +2105,7 @@ void mailbox_save_cancel(struct mail_save_context **_ctx)
 
        *_ctx = NULL;
        ctx->transaction->box->v.save_cancel(ctx);
-       if (keywords != NULL)
+       if (keywords != NULL && !ctx->finishing)
                mailbox_keywords_unref(&keywords);
        if (ctx->dest_mail != NULL) {
                /* the dest_mail is no longer valid. if we're still saving
@@ -2144,7 +2147,9 @@ int mailbox_copy(struct mail_save_context **_ctx, struct mail *mail)
                mailbox_save_cancel(&ctx);
                return -1;
        }
+       ctx->finishing = TRUE;
        ret = t->box->v.copy(ctx, backend_mail);
+       ctx->finishing = FALSE;
        if (ret == 0) {
                if (pvt_flags != 0)
                        mailbox_save_add_pvt_flags(t, pvt_flags);