dovecot-2.0: imap: Memory leak fixes for invalid parameter handl...

[dovecot at dovecot.org]

details:   http://hg.dovecot.org/dovecot-2.0/rev/9007d5de0e87
changeset: 12941:9007d5de0e87
user:      Timo Sirainen <tss at iki.fi>
date:      Fri Sep 30 19:03:49 2011 +0300
description:
imap: Memory leak fixes for invalid parameter handling.

diffstat:

 src/imap/cmd-copy.c         |   6 +++++-
 src/imap/cmd-expunge.c      |  10 ++++++----
 src/imap/cmd-store.c        |   5 ++++-
 src/imap/imap-search-args.c |   2 ++
 4 files changed, 17 insertions(+), 6 deletions(-)

diffs (93 lines):

diff -r 3d1b4d0b5880 -r 9007d5de0e87 src/imap/cmd-copy.c
--- a/src/imap/cmd-copy.c	Mon Sep 26 21:55:10 2011 +0300
+++ b/src/imap/cmd-copy.c	Fri Sep 30 19:03:49 2011 +0300
@@ -112,8 +112,10 @@
 
 	/* open the destination mailbox */
 	dest_ns = client_find_namespace(cmd, mailbox, &storage_name, &status);
-	if (dest_ns == NULL)
+	if (dest_ns == NULL) {
+		mail_search_args_unref(&search_args);
 		return TRUE;
+	}
 
 	switch (status) {
 	case MAILBOX_NAME_EXISTS_MAILBOX:
@@ -126,6 +128,7 @@
 	case MAILBOX_NAME_NOINFERIORS:
 		client_fail_mailbox_name_status(cmd, mailbox,
 						"TRYCREATE", status);
+		mail_search_args_unref(&search_args);
 		return TRUE;
 	}
 
@@ -139,6 +142,7 @@
 			client_send_storage_error(cmd,
 				mailbox_get_storage(destbox));
 			mailbox_free(&destbox);
+			mail_search_args_unref(&search_args);
 			return TRUE;
 		}
 		if (client->enabled_features != 0)
diff -r 3d1b4d0b5880 -r 9007d5de0e87 src/imap/cmd-expunge.c
--- a/src/imap/cmd-expunge.c	Mon Sep 26 21:55:10 2011 +0300
+++ b/src/imap/cmd-expunge.c	Fri Sep 30 19:03:49 2011 +0300
@@ -23,15 +23,17 @@
 			       struct mail_search_args *search_args)
 {
 	struct client *client = cmd->client;
+	int ret;
 
-	if (imap_expunge(client->mailbox, search_args == NULL ? NULL :
-			 search_args->args) < 0) {
+	ret = imap_expunge(client->mailbox, search_args == NULL ? NULL :
+			   search_args->args);
+	if (search_args != NULL)
+		mail_search_args_unref(&search_args);
+	if (ret < 0) {
 		client_send_storage_error(cmd,
 					  mailbox_get_storage(client->mailbox));
 		return TRUE;
 	}
-	if (search_args != NULL)
-		mail_search_args_unref(&search_args);
 
 	client->sync_seen_deletes = FALSE;
 	client->sync_seen_expunges = FALSE;
diff -r 3d1b4d0b5880 -r 9007d5de0e87 src/imap/cmd-store.c
--- a/src/imap/cmd-store.c	Mon Sep 26 21:55:10 2011 +0300
+++ b/src/imap/cmd-store.c	Fri Sep 30 19:03:49 2011 +0300
@@ -149,10 +149,13 @@
 
 	memset(&ctx, 0, sizeof(ctx));
 	ctx.cmd = cmd;
-	if (!store_parse_args(&ctx, ++args))
+	if (!store_parse_args(&ctx, ++args)) {
+		mail_search_args_unref(&search_args);
 		return TRUE;
+	}
 
 	if (client->mailbox_examined) {
+		mail_search_args_unref(&search_args);
 		if (ctx.max_modseq < (uint64_t)-1)
 			reply = "NO CONDSTORE failed: Mailbox is read-only.";
 		else
diff -r 3d1b4d0b5880 -r 9007d5de0e87 src/imap/imap-search-args.c
--- a/src/imap/imap-search-args.c	Mon Sep 26 21:55:10 2011 +0300
+++ b/src/imap/imap-search-args.c	Fri Sep 30 19:03:49 2011 +0300
@@ -112,6 +112,7 @@
 	    !msgset_is_valid(&args->args->value.seqset,
 			     cmd->client->messages_count)) {
 		*error_r = "Invalid messageset";
+		mail_search_args_unref(&args);
 		return -1;
 	}
 	*args_r = args;
@@ -130,6 +131,7 @@
 	p_array_init(&args->args->value.seqset, args->pool, 16);
 	if (imap_seq_set_parse(uidset, &args->args->value.seqset) < 0) {
 		*error_r = "Invalid uidset";
+		mail_search_args_unref(&args);
 		return -1;
 	}