[dovecot-cvs] dovecot/src/imap-login client.c,1.38,1.39

[cras at dovecot.org]

Update of /var/lib/cvs/dovecot/src/imap-login
In directory talvi:/tmp/cvs-serv2373/imap-login

Modified Files:
	client.c 
Log Message:
Don't destroy client structure immediately when sending line fails. Fixes some writes to freed memory.



Index: client.c
===================================================================
RCS file: /var/lib/cvs/dovecot/src/imap-login/client.c,v
retrieving revision 1.38
retrieving revision 1.39
diff -u -d -r1.38 -r1.39
--- client.c	28 Oct 2004 15:22:35 -0000	1.38
+++ client.c	28 Nov 2004 00:04:29 -0000	1.39
@@ -429,6 +429,8 @@
 
 	client_send_line(client, str_c(greet));
 	client_set_title(client);
+
+	client->created = TRUE;
 	return &client->common;
 }
 
@@ -531,10 +533,14 @@
 	iov[1].iov_base = "\r\n";
 	iov[1].iov_len = 2;
 
-	if ((ret = o_stream_sendv(client->output, iov, 2)) < 0)
-		client_destroy(client, "Disconnected");
-	else if ((size_t)ret != iov[0].iov_len + iov[1].iov_len)
-		client_destroy(client, "Transmit buffer full");
+	ret = o_stream_sendv(client->output, iov, 2);
+	if (ret < 0 || (size_t)ret != iov[0].iov_len + iov[1].iov_len) {
+		/* either disconnection or buffer full. in either case we
+		   want this connection destroyed. however destroying it here
+		   might break things if client is still tried to be accessed
+		   without being referenced.. */
+		i_stream_close(client->input);
+	}
 }
 
 void client_send_tagline(struct imap_client *client, const char *line)