imapc: Fix use after free in attribute iteration

When imapc_storage_attribute_context_destroy() is invoked from
imapc_storage_attribute_iter_destroy(), *_actx resides inside
the actx->pool that is going to be unreferenced.

Broken by ae33493d89136f4982b5ee6e8b0f66ff57cea721

diff --git a/src/lib-storage/index/imapc/imapc-attribute.c b/src/lib-storage/index/imapc/imapc-attribute.c
index 577075d8947c30a8a2df58bc15811c91ae0295bc..1ea7c07f263252aa5758f2c66a9fc5bc4af5fe3a 100644 (file)
--- a/src/lib-storage/index/imapc/imapc-attribute.c
+++ b/src/lib-storage/index/imapc/imapc-attribute.c
@@ -39,8 +39,8 @@ static void
 imapc_storage_attribute_context_destroy(struct imapc_storage_attribute_context **_actx)
 {
        struct imapc_storage_attribute_context *actx = *_actx;
-       pool_unref(&actx->pool);
        *_actx = NULL;
+       pool_unref(&actx->pool);
 }
 
 static struct imapc_storage_attribute_iter *imapc_storage_attribute_iter_create()