dovecot-2.2: lib-http: Don't crash if request callback manages t...

[dovecot at dovecot.org]

details:   http://hg.dovecot.org/dovecot-2.2/rev/5606f1a6cbc6
changeset: 16015:5606f1a6cbc6
user:      Timo Sirainen <tss at iki.fi>
date:      Sun Mar 10 20:49:51 2013 +0200
description:
lib-http: Don't crash if request callback manages to get the connection destroyed.

diffstat:

 src/lib-http/http-client-connection.c |  15 ++++++++++++---
 1 files changed, 12 insertions(+), 3 deletions(-)

diffs (39 lines):

diff -r 81172305f1b2 -r 5606f1a6cbc6 src/lib-http/http-client-connection.c
--- a/src/lib-http/http-client-connection.c	Sun Mar 10 20:38:35 2013 +0200
+++ b/src/lib-http/http-client-connection.c	Sun Mar 10 20:49:51 2013 +0200
@@ -373,6 +373,7 @@
 	struct http_client_request *req, struct http_response *response)
 {
 	struct istream *payload;
+	bool retrying;
 
 	i_assert(conn->incoming_payload == NULL);
 	i_assert(conn->pending_request == NULL);
@@ -392,7 +393,17 @@
 		io_remove(&conn->conn.io);
 	}
 
-	if (!http_client_request_callback(req, response)) {
+	http_client_connection_ref(conn);
+	retrying = !http_client_request_callback(req, response);
+	http_client_connection_unref(&conn);
+	if (conn == NULL) {
+		/* the callback managed to get this connection destroyed */
+		if (!retrying)
+			http_client_request_finish(&req);
+		return FALSE;
+	}
+
+	if (retrying) {
 		/* retrying, don't destroy the request */
 		if (response->payload != NULL) {
 			i_stream_unset_destroy_callback(conn->incoming_payload);
@@ -404,8 +415,6 @@
 		return TRUE;
 	}
 
-	// FIXME: conn may be freed at this point..
-
 	if (response->payload != NULL) {
 		req->state = HTTP_REQUEST_STATE_PAYLOAD_IN;
 		payload = response->payload;