From: Timo Sirainen <tss@iki.fi>
Date: Tue, 29 Apr 2014 10:35:06 +0000 (+0300)
Subject: lib-storage: Fixed crash if mailbox_save_cancel() was called in save_finish()/copy... 
X-Git-Tag: 2.2.13.rc1~74
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ba8ff75a149d6936f769a2d1dfceaab9da87863b;p=thirdparty%2Fdovecot%2Fcore.git

lib-storage: Fixed crash if mailbox_save_cancel() was called in save_finish()/copy() method.
---

diff --git a/src/lib-storage/mail-storage-private.h b/src/lib-storage/mail-storage-private.h
index 6d3c2c10cb..c605af2c1a 100644
--- a/src/lib-storage/mail-storage-private.h
+++ b/src/lib-storage/mail-storage-private.h
@@ -559,6 +559,8 @@ struct mail_save_context {
 	/* mailbox_save_alloc() called, but finish/cancel not.
 	   the same context is usually returned by the backends for reuse. */
 	unsigned int unfinished:1;
+	/* mailbox_save_finish() or mailbox_copy() is being called. */
+	unsigned int finishing:1;
 	/* mail was copied using saving */
 	unsigned int copying_via_save:1;
 	/* mail is being saved, not copied */
diff --git a/src/lib-storage/mail-storage.c b/src/lib-storage/mail-storage.c
index f7d2fc9402..d7b43bc70a 100644
--- a/src/lib-storage/mail-storage.c
+++ b/src/lib-storage/mail-storage.c
@@ -2081,7 +2081,10 @@ int mailbox_save_finish(struct mail_save_context **_ctx)
 	}
 	*_ctx = NULL;
 
+	ctx->finishing = TRUE;
 	ret = t->box->v.save_finish(ctx);
+	ctx->finishing = FALSE;
+
 	if (ret == 0 && !copying_via_save) {
 		if (pvt_flags != 0)
 			mailbox_save_add_pvt_flags(t, pvt_flags);
@@ -2102,7 +2105,7 @@ void mailbox_save_cancel(struct mail_save_context **_ctx)
 
 	*_ctx = NULL;
 	ctx->transaction->box->v.save_cancel(ctx);
-	if (keywords != NULL)
+	if (keywords != NULL && !ctx->finishing)
 		mailbox_keywords_unref(&keywords);
 	if (ctx->dest_mail != NULL) {
 		/* the dest_mail is no longer valid. if we're still saving
@@ -2144,7 +2147,9 @@ int mailbox_copy(struct mail_save_context **_ctx, struct mail *mail)
 		mailbox_save_cancel(&ctx);
 		return -1;
 	}
+	ctx->finishing = TRUE;
 	ret = t->box->v.copy(ctx, backend_mail);
+	ctx->finishing = FALSE;
 	if (ret == 0) {
 		if (pvt_flags != 0)
 			mailbox_save_add_pvt_flags(t, pvt_flags);