From: Timo Sirainen <tss@iki.fi>
Date: Mon, 28 Sep 2015 10:51:49 +0000 (+0300)
Subject: lib-http: Disconnection from HTTP server could have caused accessing already freed... 
X-Git-Tag: 2.2.19.rc2~17
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e312e229f27f3c4bfeccc17bfa008e90e29253df;p=thirdparty%2Fdovecot%2Fcore.git

lib-http: Disconnection from HTTP server could have caused accessing already freed memory.
Freeing a request could have freed the connection.
---

diff --git a/src/lib-http/http-client-connection.c b/src/lib-http/http-client-connection.c
index 543152319d..28d134d5d8 100644
--- a/src/lib-http/http-client-connection.c
+++ b/src/lib-http/http-client-connection.c
@@ -487,7 +487,7 @@ http_client_connection_return_response(struct http_client_connection *conn,
 	struct http_client_request *req, struct http_response *response)
 {
 	struct istream *payload;
-	bool retrying;
+	bool retrying, ret;
 
 	i_assert(!conn->in_req_callback);
 	i_assert(conn->incoming_payload == NULL);
@@ -541,6 +541,7 @@ http_client_connection_return_response(struct http_client_connection *conn,
 		return TRUE;
 	}
 
+	http_client_connection_ref(conn);
 	if (response->payload != NULL) {
 		req->state = HTTP_REQUEST_STATE_PAYLOAD_IN;
 		payload = response->payload;
@@ -563,10 +564,12 @@ http_client_connection_return_response(struct http_client_connection *conn,
 	if (conn->incoming_payload == NULL) {
 		i_assert(conn->conn.io != NULL ||
 			conn->peer->addr.type == HTTP_CLIENT_PEER_ADDR_RAW);
-		return TRUE;
+		ret = TRUE;
+	} else {
+		ret = FALSE;
 	}
-
-	return FALSE;
+	http_client_connection_unref(&conn);
+	return ret;
 }
 
 static void http_client_connection_input(struct connection *_conn)