From: Marco Bettini <marco.bettini@open-xchange.com>
Date: Thu, 6 Jul 2023 07:12:23 +0000 (+0000)
Subject: imap-urlauth: clients_deinit(): Fix use after free
X-Git-Tag: 2.4.0~2650
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=08dda7768ef25c9a6a10f1ef0e44c60070d39424;p=thirdparty%2Fdovecot%2Fcore.git

imap-urlauth: clients_deinit(): Fix use after free

Found by coverity.
---

diff --git a/src/imap-urlauth/imap-urlauth-client.c b/src/imap-urlauth/imap-urlauth-client.c
index 6d33122aea..30fe87a13f 100644
--- a/src/imap-urlauth/imap-urlauth-client.c
+++ b/src/imap-urlauth/imap-urlauth-client.c
@@ -189,10 +189,11 @@ void clients_init(void)
 
 void clients_deinit(void)
 {
-	struct connection *conn;
+	struct connection *conn, *next;
+
+	for (conn = imap_urlauth_clist->connections; conn != NULL; conn = next) {
+		next = conn->next; /* client_destroy() frees client & conn */
 
-	for (conn = imap_urlauth_clist->connections;
-	     conn != NULL; conn = conn->next) {
 		struct client *client = container_of(conn, struct client, conn);
 
 		client_destroy(client, MASTER_SERVICE_SHUTTING_DOWN_MSG);