lib-smtp: server: Make sure command object is not used after it is de…

…stroyed in hook.
dovecot · Nov 1, 2018 · eeca44f · eeca44f
1 parent a882b18
commit eeca44f
Show file tree

Hide file tree

Showing 3 changed files with 27 additions and 15 deletions.
diff --git a/src/lib-smtp/smtp-server-command.c b/src/lib-smtp/smtp-server-command.c
@@ -421,32 +421,41 @@ void smtp_server_command_ready_to_reply(struct smtp_server_command *cmd)
 	smtp_server_connection_trigger_output(cmd->context.conn);
 }
 
-void smtp_server_command_next_to_reply(struct smtp_server_command *cmd)
+bool smtp_server_command_next_to_reply(struct smtp_server_command **_cmd)
 {
+	struct smtp_server_command *cmd = *_cmd;
+
 	smtp_server_command_debug(&cmd->context, "Next to reply");
 
-	smtp_server_command_call_hooks(&cmd, SMTP_SERVER_COMMAND_HOOK_NEXT);
+	return smtp_server_command_call_hooks(
+		_cmd, SMTP_SERVER_COMMAND_HOOK_NEXT);
 }
 
-static void
-smtp_server_command_replied(struct smtp_server_command *cmd)
+static bool
+smtp_server_command_replied(struct smtp_server_command **_cmd)
 {
+	struct smtp_server_command *cmd = *_cmd;
+
 	if (cmd->replies_submitted < cmd->replies_expected)
-		return;
+		return TRUE;
 
 	smtp_server_command_debug(&cmd->context, "Replied");
 
-	smtp_server_command_call_hooks(&cmd, SMTP_SERVER_COMMAND_HOOK_REPLIED);
+	return smtp_server_command_call_hooks(
+		_cmd, SMTP_SERVER_COMMAND_HOOK_REPLIED);
 }
 
-void smtp_server_command_completed(struct smtp_server_command *cmd)
+bool smtp_server_command_completed(struct smtp_server_command **_cmd)
 {
+	struct smtp_server_command *cmd = *_cmd;
+
 	if (cmd->replies_submitted < cmd->replies_expected)
-		return;
+		return TRUE;
 
 	smtp_server_command_debug(&cmd->context, "Completed");
 
-	smtp_server_command_call_hooks(&cmd, SMTP_SERVER_COMMAND_HOOK_COMPLETED);
+	return smtp_server_command_call_hooks(
+		_cmd, SMTP_SERVER_COMMAND_HOOK_COMPLETED);
 }
 
 static bool
@@ -456,7 +465,8 @@ smtp_server_command_handle_reply(struct smtp_server_command *cmd)
 
 	smtp_server_connection_ref(conn);
 
-	smtp_server_command_replied(cmd);
+	if (!smtp_server_command_replied(&cmd))
+		return smtp_server_connection_unref(&conn);
 
 	/* submit reply */
 	switch (cmd->state) {

diff --git a/src/lib-smtp/smtp-server-connection.c b/src/lib-smtp/smtp-server-connection.c
@@ -333,7 +333,7 @@ smtp_server_connection_handle_command(struct smtp_server_connection *conn,
 	}
 
 	if (cmd != NULL && conn->command_queue_head == cmd)
-		smtp_server_command_next_to_reply(cmd);
+		(void)smtp_server_command_next_to_reply(&cmd);
 
 	smtp_server_connection_timeout_update(conn);
 	return (cmd == NULL || !cmd->input_locked);
@@ -668,14 +668,15 @@ smtp_server_connection_next_reply(struct smtp_server_connection *conn)
 	}
 
 	if (cmd->state < SMTP_SERVER_COMMAND_STATE_READY_TO_REPLY) {
-		smtp_server_command_next_to_reply(cmd);
+		(void)smtp_server_command_next_to_reply(&cmd);
 		return FALSE;
 	}
 
 	i_assert(cmd->state == SMTP_SERVER_COMMAND_STATE_READY_TO_REPLY &&
 		 array_is_created(&cmd->replies));
 
-	smtp_server_command_completed(cmd);
+	if (!smtp_server_command_completed(&cmd))
+		return TRUE;
 
 	/* send command replies */
 	// FIXME: handle LMTP DATA command with enormous number of recipients;

diff --git a/src/lib-smtp/smtp-server-private.h b/src/lib-smtp/smtp-server-private.h
@@ -265,10 +265,11 @@ void smtp_server_command_submit_reply(struct smtp_server_command *cmd);
 int smtp_server_connection_flush(struct smtp_server_connection *conn);
 
 void smtp_server_command_ready_to_reply(struct smtp_server_command *cmd);
-void smtp_server_command_next_to_reply(struct smtp_server_command *cmd);
-void smtp_server_command_completed(struct smtp_server_command *cmd);
 void smtp_server_command_finished(struct smtp_server_command *cmd);
 
+bool smtp_server_command_next_to_reply(struct smtp_server_command **_cmd);
+bool smtp_server_command_completed(struct smtp_server_command **_cmd);
+
 static inline bool
 smtp_server_command_is_complete(struct smtp_server_command *cmd)
 {