From: Timo Sirainen <tss@iki.fi>
Date: Sun, 10 Mar 2013 18:49:51 +0000 (+0200)
Subject: lib-http: Don't crash if request callback manages to get the connection destroyed.
X-Git-Tag: 2.2.rc3~58
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ab4bd2aaf8d897dbfa61d3e3ec943685b2e85e4e;p=thirdparty%2Fdovecot%2Fcore.git

lib-http: Don't crash if request callback manages to get the connection destroyed.
---

diff --git a/src/lib-http/http-client-connection.c b/src/lib-http/http-client-connection.c
index d4bc06590c..61d0713728 100644
--- a/src/lib-http/http-client-connection.c
+++ b/src/lib-http/http-client-connection.c
@@ -373,6 +373,7 @@ http_client_connection_return_response(struct http_client_connection *conn,
 	struct http_client_request *req, struct http_response *response)
 {
 	struct istream *payload;
+	bool retrying;
 
 	i_assert(conn->incoming_payload == NULL);
 	i_assert(conn->pending_request == NULL);
@@ -392,7 +393,17 @@ http_client_connection_return_response(struct http_client_connection *conn,
 		io_remove(&conn->conn.io);
 	}
 
-	if (!http_client_request_callback(req, response)) {
+	http_client_connection_ref(conn);
+	retrying = !http_client_request_callback(req, response);
+	http_client_connection_unref(&conn);
+	if (conn == NULL) {
+		/* the callback managed to get this connection destroyed */
+		if (!retrying)
+			http_client_request_finish(&req);
+		return FALSE;
+	}
+
+	if (retrying) {
 		/* retrying, don't destroy the request */
 		if (response->payload != NULL) {
 			i_stream_unset_destroy_callback(conn->incoming_payload);
@@ -404,8 +415,6 @@ http_client_connection_return_response(struct http_client_connection *conn,
 		return TRUE;
 	}
 
-	// FIXME: conn may be freed at this point..
-
 	if (response->payload != NULL) {
 		req->state = HTTP_REQUEST_STATE_PAYLOAD_IN;
 		payload = response->payload;