From: Timo Sirainen <tss@iki.fi>
Date: Mon, 28 Jun 2010 12:19:24 +0000 (+0100)
Subject: quota: Fixed a potential crash with dict quota at deinit.
X-Git-Tag: 2.0.rc1~77
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6b43203878bd3c87f5ae690617a1cbc694e24c01;p=thirdparty%2Fdovecot%2Fcore.git

quota: Fixed a potential crash with dict quota at deinit.

--HG--
branch : HEAD
---

diff --git a/src/plugins/quota/quota.c b/src/plugins/quota/quota.c
index 078978ed17..a8ec7d27f4 100644
--- a/src/plugins/quota/quota.c
+++ b/src/plugins/quota/quota.c
@@ -282,11 +282,13 @@ void quota_deinit(struct quota **_quota)
 	struct quota_root *const *roots;
 	unsigned int i, count;
 
-	*_quota = NULL;
-
 	roots = array_get(&quota->roots, &count);
 	for (i = 0; i < count; i++)
 		quota_root_deinit(roots[i]);
+
+	/* deinit quota roots before setting quser->quota=NULL */
+	*_quota = NULL;
+
 	array_free(&quota->roots);
 	array_free(&quota->namespaces);
 	i_free(quota);
@@ -839,6 +841,8 @@ struct quota_transaction_context *quota_transaction_begin(struct mailbox *box)
 	ctx->quota = box->list->ns->owner != NULL ?
 		quota_get_mail_user_quota(box->list->ns->owner) :
 		quota_get_mail_user_quota(box->list->ns->user);
+	i_assert(ctx->quota != NULL);
+
 	ctx->box = box;
 	ctx->bytes_left = (uint64_t)-1;
 	ctx->count_left = (uint64_t)-1;