From: Timo Sirainen <tss@iki.fi>
Date: Wed, 29 Oct 2014 00:07:21 +0000 (-0700)
Subject: lib: io_remove() should finish closing the io before unreferencing its istream.
X-Git-Tag: 2.2.16.rc1~267
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fde8872151fcf82c3bc862d21a6b72acfe0fb171;p=thirdparty%2Fdovecot%2Fcore.git

lib: io_remove() should finish closing the io before unreferencing its istream.
This is because the istream unreferencing may close the fd.
---

diff --git a/src/lib/ioloop.c b/src/lib/ioloop.c
index d5a014f4dd..ba4d403e28 100644
--- a/src/lib/ioloop.c
+++ b/src/lib/ioloop.c
@@ -136,16 +136,19 @@ static void io_remove_full(struct io **_io, bool closed)
 		io_loop_notify_remove(io);
 	else {
 		struct io_file *io_file = (struct io_file *)io;
-
-		if (io_file->istream != NULL) {
-			i_stream_unset_io(io_file->istream, io);
-			i_stream_unref(&io_file->istream);
-			io_file->istream = NULL;
-		}
+		struct istream *istream = io_file->istream;
 
 		io_file_unlink(io_file);
 		if (io_file->fd != -1)
 			io_loop_handle_remove(io_file, closed);
+
+		/* remove io from the ioloop before unreferencing the istream,
+		   because a destroyed istream may automatically close the
+		   fd. */
+		if (istream != NULL) {
+			i_stream_unset_io(istream, io);
+			i_stream_unref(&istream);
+		}
 	}
 }