[dovecot-cvs] dovecot/src/pop3 client.c, 1.59, 1.60 commands.c, 1.51, 1.52 main.c, 1.38, 1.39

[cras at dovecot.org]

Update of /var/lib/cvs/dovecot/src/pop3
In directory talvi:/tmp/cvs-serv16037/pop3

Modified Files:
	client.c commands.c main.c 
Log Message:
deinit, unref, destroy, close, free, etc. functions now take a pointer to
their data pointer, and set it to NULL. This makes double-frees less likely
to cause security holes.



Index: client.c
===================================================================
RCS file: /var/lib/cvs/dovecot/src/pop3/client.c,v
retrieving revision 1.59
retrieving revision 1.60
diff -u -d -r1.59 -r1.60
--- client.c	13 Jan 2006 20:26:48 -0000	1.59
+++ client.c	14 Jan 2006 18:48:17 -0000	1.60
@@ -46,7 +46,7 @@
 	ctx = mailbox_sync_init(box, MAILBOX_SYNC_FLAG_FULL_READ);
 	while (mailbox_sync_next(ctx, &sync_rec) > 0)
 		;
-	return mailbox_sync_deinit(ctx, status);
+	return mailbox_sync_deinit(&ctx, status);
 }
 
 static int init_mailbox(struct client *client)
@@ -76,7 +76,7 @@
 		ctx = mailbox_search_init(t, NULL, &search_arg, NULL);
 		if (ctx == NULL) {
 			client_send_storage_error(client);
-			mailbox_transaction_rollback(t);
+			mailbox_transaction_rollback(&t);
 			break;
 		}
 
@@ -103,10 +103,10 @@
 		client->messages_count =
 			message_sizes_buf->used / sizeof(uoff_t);
 
-		mail_free(mail);
-		if (mailbox_search_deinit(ctx) < 0) {
+		mail_free(&mail);
+		if (mailbox_search_deinit(&ctx) < 0) {
 			client_send_storage_error(client);
-			mailbox_transaction_rollback(t);
+			mailbox_transaction_rollback(&t);
 			break;
 		}
 
@@ -118,7 +118,7 @@
 		}
 
 		/* well, sync and try again */
-		mailbox_transaction_rollback(t);
+		mailbox_transaction_rollback(&t);
 	}
 
 	if (i == 2)
@@ -220,19 +220,19 @@
 		i_assert(client->cmd == NULL);
 	}
 	if (client->trans != NULL)
-		mailbox_transaction_rollback(client->trans);
+		mailbox_transaction_rollback(&client->trans);
 	if (client->mailbox != NULL)
-		mailbox_close(client->mailbox);
-	mail_storage_destroy(client->storage);
+		mailbox_close(&client->mailbox);
+	mail_storage_destroy(&client->storage);
 
 	i_free(client->message_sizes);
 	i_free(client->deleted_bitmask);
 
 	if (client->io != NULL)
-		io_remove(client->io);
+		io_remove(&client->io);
 
-	i_stream_unref(client->input);
-	o_stream_unref(client->output);
+	i_stream_unref(&client->input);
+	o_stream_unref(&client->output);
 
 	i_free(client);
 
@@ -281,8 +281,7 @@
 			if (client->io != NULL) {
 				/* no more input until client has read
 				   our output */
-				io_remove(client->io);
-				client->io = NULL;
+				io_remove(&client->io);
 
 				/* If someone happens to flush output,
 				   we want to get our IO handler back in
@@ -325,8 +324,7 @@
 	if (client->cmd != NULL) {
 		/* we're still processing a command. wait until it's
 		   finished. */
-		io_remove(client->io);
-		client->io = NULL;
+		io_remove(&client->io);
 		client->waiting_input = TRUE;
 		return;
 	}
@@ -441,5 +439,5 @@
 		client_destroy(my_client, "Server shutting down.");
 	}
 
-	timeout_remove(to_idle);
+	timeout_remove(&to_idle);
 }

Index: commands.c
===================================================================
RCS file: /var/lib/cvs/dovecot/src/pop3/commands.c,v
retrieving revision 1.51
retrieving revision 1.52
diff -u -d -r1.51 -r1.52
--- commands.c	13 Jan 2006 20:26:48 -0000	1.51
+++ commands.c	14 Jan 2006 18:48:17 -0000	1.52
@@ -213,9 +213,9 @@
 			}
 		}
 	}
-	mail_free(mail);
+	mail_free(&mail);
 
-	if (mailbox_search_deinit(ctx) < 0)
+	if (mailbox_search_deinit(&ctx) < 0)
 		ret = FALSE;
 	return ret;
 }
@@ -231,8 +231,8 @@
 		}
 	}
 
-	mailbox_transaction_commit(client->trans, MAILBOX_SYNC_FLAG_FULL_WRITE);
-	client->trans = NULL;
+	mailbox_transaction_commit(&client->trans,
+				   MAILBOX_SYNC_FLAG_FULL_WRITE);
 
 	if (!client->deleted)
 		client_send_line(client, "+OK Logging out.");
@@ -258,8 +258,8 @@
 
 static void fetch_deinit(struct fetch_context *ctx)
 {
-	(void)mailbox_search_deinit(ctx->search_ctx);
-	mail_free(ctx->mail);
+	(void)mailbox_search_deinit(&ctx->search_ctx);
+	mail_free(&ctx->mail);
 	i_free(ctx);
 }
 
@@ -443,7 +443,7 @@
 	}
 
 	/* forget all our seen flag updates as well.. */
-	mailbox_transaction_rollback(client->trans);
+	mailbox_transaction_rollback(&client->trans);
 	client->trans = mailbox_transaction_begin(client->mailbox, 0);
 
 	if (enable_last_command) {
@@ -463,8 +463,8 @@
 					      MAIL_SEEN) < 0)
 				break;
 		}
-		mail_free(mail);
-		(void)mailbox_search_deinit(search_ctx);
+		mail_free(&mail);
+		(void)mailbox_search_deinit(&search_ctx);
 	}
 
 	client_send_line(client, "+OK");
@@ -579,15 +579,15 @@
 		if (ret == 0 && ctx->message == 0) {
 			/* output is being buffered, continue when there's
 			   more space */
-			str_free(str);
+			str_free(&str);
 			return 0;
 		}
 	}
-	str_free(str);
+	str_free(&str);
 
 	/* finished */
-	mail_free(ctx->mail);
-	(void)mailbox_search_deinit(ctx->search_ctx);
+	mail_free(&ctx->mail);
+	(void)mailbox_search_deinit(&ctx->search_ctx);
 
 	client->cmd = NULL;
 

Index: main.c
===================================================================
RCS file: /var/lib/cvs/dovecot/src/pop3/main.c,v
retrieving revision 1.38
retrieving revision 1.39
diff -u -d -r1.38 -r1.39
--- main.c	13 Jan 2006 20:26:48 -0000	1.38
+++ main.c	14 Jan 2006 18:48:17 -0000	1.39
@@ -251,7 +251,7 @@
 
 static void main_deinit(void)
 {
-	module_dir_unload(modules);
+	module_dir_unload(&modules);
 
 	clients_deinit();
         mail_storage_deinit();
@@ -287,7 +287,7 @@
 		io_loop_run(ioloop);
 	main_deinit();
 
-	io_loop_destroy(ioloop);
+	io_loop_destroy(&ioloop);
 	lib_deinit();
 
 	return 0;