# HG changeset patch
# User Timo Sirainen <timo.sirainen@dovecot.fi>
# Date 1451936041 18000
# Node ID dfee8dea71b69dbbcd9b1cddff9f487a88d9e01e
# Parent  304b06f6302cee0a5ecd36091ad68832904d6bd2
imap: Avoid crashing at deinit if mail_user_unref() triggers mail_storage_callbacks

This could have happened with Maildir/mbox and autoexpunging.

diff -r 304b06f6302c -r dfee8dea71b6 src/imap/imap-client.c
--- a/src/imap/imap-client.c	Mon Jan 04 14:23:46 2016 -0500
+++ b/src/imap/imap-client.c	Mon Jan 04 14:34:01 2016 -0500
@@ -385,9 +385,7 @@
 		timeout_remove(&client->to_delayed_input);
 	timeout_remove(&client->to_idle);
 
-	i_stream_destroy(&client->input);
-	o_stream_destroy(&client->output);
-
+	/* i/ostreams are already closed at this stage, so fd can be closed */
 	net_disconnect(client->fd_in);
 	if (client->fd_in != client->fd_out)
 		net_disconnect(client->fd_out);
@@ -396,6 +394,11 @@
 	   some background work like autoexpunging. */
 	mail_user_unref(&client->user);
 
+	/* free the i/ostreams after mail_user_unref(), which could trigger
+	   mail_storage_callbacks notifications that write to the ostream. */
+	i_stream_destroy(&client->input);
+	o_stream_destroy(&client->output);
+
 	if (array_is_created(&client->search_saved_uidset))
 		array_free(&client->search_saved_uidset);
 	if (array_is_created(&client->search_updates))