dovecot-2.2: lib-http: Disconnection from HTTP server could have...

[dovecot at dovecot.org]

details:   http://hg.dovecot.org/dovecot-2.2/rev/44dd7e81a38b
changeset: 19234:44dd7e81a38b
user:      Timo Sirainen <tss at iki.fi>
date:      Mon Sep 28 13:51:49 2015 +0300
description:
lib-http: Disconnection from HTTP server could have caused accessing already freed memory.
Freeing a request could have freed the connection.

diffstat:

 src/lib-http/http-client-connection.c |  11 +++++++----
 1 files changed, 7 insertions(+), 4 deletions(-)

diffs (36 lines):

diff -r 14f670053196 -r 44dd7e81a38b src/lib-http/http-client-connection.c
--- a/src/lib-http/http-client-connection.c	Mon Sep 28 12:33:33 2015 +0300
+++ b/src/lib-http/http-client-connection.c	Mon Sep 28 13:51:49 2015 +0300
@@ -487,7 +487,7 @@
 	struct http_client_request *req, struct http_response *response)
 {
 	struct istream *payload;
-	bool retrying;
+	bool retrying, ret;
 
 	i_assert(!conn->in_req_callback);
 	i_assert(conn->incoming_payload == NULL);
@@ -541,6 +541,7 @@
 		return TRUE;
 	}
 
+	http_client_connection_ref(conn);
 	if (response->payload != NULL) {
 		req->state = HTTP_REQUEST_STATE_PAYLOAD_IN;
 		payload = response->payload;
@@ -563,10 +564,12 @@
 	if (conn->incoming_payload == NULL) {
 		i_assert(conn->conn.io != NULL ||
 			conn->peer->addr.type == HTTP_CLIENT_PEER_ADDR_RAW);
-		return TRUE;
+		ret = TRUE;
+	} else {
+		ret = FALSE;
 	}
-
-	return FALSE;
+	http_client_connection_unref(&conn);
+	return ret;
 }
 
 static void http_client_connection_input(struct connection *_conn)