From e009b0d73b3421b58919ba1ef0548169d9cf7acd Mon Sep 17 00:00:00 2001 From: Stephan Bosch Date: Tue, 31 Jan 2017 13:41:48 +0100 Subject: [PATCH] lib-http: server: Fix premature connection destroy in http_server_connection_output(). Added a reference to the connection object while it is sending the remainder of a response's payload. This is necessary, since http_server_response_send_more() can destroy the connection, for example when the request has a "Connection: close" header. This will only occur for responses with a very large payload, because otherwise the payload is fully sent in in the initial pass. --- src/lib-http/http-server-connection.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/lib-http/http-server-connection.c b/src/lib-http/http-server-connection.c index 6c3496ffe8..9d80331d23 100644 --- a/src/lib-http/http-server-connection.c +++ b/src/lib-http/http-server-connection.c @@ -954,6 +954,7 @@ int http_server_connection_output(struct http_server_connection *conn) { bool pipeline_was_full = http_server_connection_pipeline_is_full(conn); + int ret; if (http_server_connection_flush(conn) < 0) return -1; @@ -966,8 +967,15 @@ int http_server_connection_output(struct http_server_connection *conn) struct http_server_response *resp = req->response; const char *error = NULL; + http_server_connection_ref(conn); + i_assert(resp != NULL); - if (http_server_response_send_more(resp, &error) < 0) { + ret = http_server_response_send_more(resp, &error); + + if (http_server_connection_unref_is_closed(conn)) + return -1; + + if (ret < 0) { http_server_connection_write_failed(conn, error); return -1; }