lib-smtp: server: recipient: Prevent reference counting from within d…

…estroy hook.
dovecot · Nov 1, 2018 · 529eb8a · 529eb8a
1 parent 144b638
commit 529eb8a
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/src/lib-smtp/smtp-server-private.h b/src/lib-smtp/smtp-server-private.h
@@ -116,6 +116,8 @@ struct smtp_server_recipient_private {
 	int refcount;
 
 	struct smtp_server_recipient_hook *hooks_head, *hooks_tail;
+
+	bool destroying:1;
 };
 
 struct smtp_server_state_data {

diff --git a/src/lib-smtp/smtp-server-recipient.c b/src/lib-smtp/smtp-server-recipient.c
@@ -33,6 +33,8 @@ void smtp_server_recipient_ref(struct smtp_server_recipient *rcpt)
 	struct smtp_server_recipient_private *prcpt =
 		(struct smtp_server_recipient_private *)rcpt;
 
+	if (prcpt->destroying)
+		return;
 	i_assert(prcpt->refcount > 0);
 	prcpt->refcount++;
 }
@@ -47,10 +49,13 @@ bool smtp_server_recipient_unref(struct smtp_server_recipient **_rcpt)
 
 	if (rcpt == NULL)
 		return FALSE;
+	if (prcpt->destroying)
+		return FALSE;
 
 	i_assert(prcpt->refcount > 0);
 	if (--prcpt->refcount > 0)
 		return TRUE;
+	prcpt->destroying = TRUE;
 
 	smtp_server_recipient_call_hooks(
 		rcpt, SMTP_SERVER_RECIPIENT_HOOK_DESTROY);