dovecot-2.2: lib-http: client: The http_client_queue_fail() func...

[dovecot at dovecot.org]

details:   http://hg.dovecot.org/dovecot-2.2/rev/b7678ce561c1
changeset: 17852:b7678ce561c1
user:      Stephan Bosch <stephan at rename-it.nl>
date:      Tue Sep 30 23:49:52 2014 +0300
description:
lib-http: client: The http_client_queue_fail() function aborted requests in an unsafe manner.
Copied queues before freeing the requests, because the destroyed requests modify the queue.

diffstat:

 src/lib-http/http-client-queue.c |  21 ++++++++++++++-------
 1 files changed, 14 insertions(+), 7 deletions(-)

diffs (37 lines):

diff -r 3773fec28b4d -r b7678ce561c1 src/lib-http/http-client-queue.c
--- a/src/lib-http/http-client-queue.c	Tue Sep 30 23:49:45 2014 +0300
+++ b/src/lib-http/http-client-queue.c	Tue Sep 30 23:49:52 2014 +0300
@@ -125,19 +125,26 @@
 void http_client_queue_fail(struct http_client_queue *queue,
 	unsigned int status, const char *error)
 {
-	struct http_client_request **req;
+	ARRAY_TYPE(http_client_request) *req_arr, treqs;
+	struct http_client_request **req_idx;
 
 	/* abort all pending requests */
-	array_foreach_modifiable(&queue->request_queue, req) {
-		http_client_request_error(*req, status, error);
+	req_arr = &queue->request_queue;
+	t_array_init(&treqs, array_count(req_arr));
+	array_copy(&treqs.arr, 0, &req_arr->arr, 0, array_count(req_arr));
+	array_foreach_modifiable(&treqs, req_idx) {
+		http_client_request_error(*req_idx, status, error);
 	}
-	array_clear(&queue->request_queue);
+	array_clear(req_arr);
 
 	/* abort all delayed requests */
-	array_foreach_modifiable(&queue->delayed_request_queue, req) {
-		http_client_request_error(*req, status, error);
+	req_arr = &queue->delayed_request_queue;
+	array_clear(&treqs);
+	array_copy(&treqs.arr, 0, &req_arr->arr, 0, array_count(req_arr));
+	array_foreach_modifiable(&treqs, req_idx) {
+		http_client_request_error(*req_idx, status, error);
 	}
-	array_clear(&queue->delayed_request_queue);
+	array_clear(req_arr);
 }
 
 void