# HG changeset patch # User Timo Sirainen # Date 1495125604 -10800 # Node ID 37e6375d19784c0ed2b1d59fc79821c3f78f327b # Parent c24c32983eae13ae7a638a4175223181c231b6fe lib-imap: imap_parser_unref() should always set parser=NULL Not just when the last reference is cleared. This is how *_unref()s should work everywhere in Dovecot. This fixes a bug in lib-imap-client where a parser could have been accessed after it was already freed. diff -r c24c32983eae -r 37e6375d1978 src/lib-imap/imap-parser.c --- a/src/lib-imap/imap-parser.c Thu May 18 18:09:56 2017 +0300 +++ b/src/lib-imap/imap-parser.c Thu May 18 19:40:04 2017 +0300 @@ -91,16 +91,18 @@ parser->refcount++; } -void imap_parser_unref(struct imap_parser **parser) +void imap_parser_unref(struct imap_parser **_parser) { - i_assert((*parser)->refcount > 0); + struct imap_parser *parser = *_parser; - if (--(*parser)->refcount > 0) + *_parser = NULL; + + i_assert(parser->refcount > 0); + if (--parser->refcount > 0) return; - pool_unref(&(*parser)->pool); - i_free(*parser); - *parser = NULL; + pool_unref(&parser->pool); + i_free(parser); } void imap_parser_reset(struct imap_parser *parser)