Skip to content

Commit

Permalink
lib-imap: imap_parser_unref() should always set parser=NULL
Browse files Browse the repository at this point in the history
Not just when the last reference is cleared. This is how *_unref()s should
work everywhere in Dovecot. This fixes a bug in lib-imap-client where a
parser could have been accessed after it was already freed.
  • Loading branch information
sirainen authored and GitLab committed May 19, 2017
1 parent f487197 commit 2e47584
Showing 1 changed file with 8 additions and 6 deletions.
14 changes: 8 additions & 6 deletions src/lib-imap/imap-parser.c
Expand Up @@ -93,16 +93,18 @@ void imap_parser_ref(struct imap_parser *parser)
parser->refcount++;
}

void imap_parser_unref(struct imap_parser **parser)
void imap_parser_unref(struct imap_parser **_parser)
{
i_assert((*parser)->refcount > 0);
struct imap_parser *parser = *_parser;

if (--(*parser)->refcount > 0)
*_parser = NULL;

i_assert(parser->refcount > 0);
if (--parser->refcount > 0)
return;

pool_unref(&(*parser)->pool);
i_free(*parser);
*parser = NULL;
pool_unref(&parser->pool);
i_free(parser);
}

void imap_parser_enable_literal_minus(struct imap_parser *parser)
Expand Down

0 comments on commit 2e47584

Please sign in to comment.