Mercurial > dovecot > original-hg > dovecot-1.2
changeset 2901:872172ffd005 HEAD
Don't destroy client structure immediately when sending line fails. Fixes some writes to freed memory.
| author | Timo Sirainen <tss@iki.fi> |
|---|---|
| date | Sun, 28 Nov 2004 02:04:29 +0200 |
| parents | d22205c4539d |
| children | 1022caefca74 |
| files | src/imap-login/client.c src/pop3-login/client.c |
| diffstat | 2 files changed, 18 insertions(+), 8 deletions(-) [+] |
line wrap: on
line diff
--- a/src/imap-login/client.c Fri Nov 26 21:15:27 2004 +0200 +++ b/src/imap-login/client.c Sun Nov 28 02:04:29 2004 +0200 @@ -429,6 +429,8 @@ client_send_line(client, str_c(greet)); client_set_title(client); + + client->created = TRUE; return &client->common; } @@ -531,10 +533,14 @@ iov[1].iov_base = "\r\n"; iov[1].iov_len = 2; - if ((ret = o_stream_sendv(client->output, iov, 2)) < 0) - client_destroy(client, "Disconnected"); - else if ((size_t)ret != iov[0].iov_len + iov[1].iov_len) - client_destroy(client, "Transmit buffer full"); + ret = o_stream_sendv(client->output, iov, 2); + if (ret < 0 || (size_t)ret != iov[0].iov_len + iov[1].iov_len) { + /* either disconnection or buffer full. in either case we + want this connection destroyed. however destroying it here + might break things if client is still tried to be accessed + without being referenced.. */ + i_stream_close(client->input); + } } void client_send_tagline(struct imap_client *client, const char *line)
--- a/src/pop3-login/client.c Fri Nov 26 21:15:27 2004 +0200 +++ b/src/pop3-login/client.c Sun Nov 28 02:04:29 2004 +0200 @@ -430,10 +430,14 @@ iov[1].iov_base = "\r\n"; iov[1].iov_len = 2; - if ((ret = o_stream_sendv(client->output, iov, 2)) < 0) - client_destroy(client, "Disconnected"); - else if ((size_t)ret != iov[0].iov_len + iov[1].iov_len) - client_destroy(client, "Transmit buffer full"); + ret = o_stream_sendv(client->output, iov, 2); + if (ret < 0 || (size_t)ret != iov[0].iov_len + iov[1].iov_len) { + /* either disconnection or buffer full. in either case we + want this connection destroyed. however destroying it here + might break things if client is still tried to be accessed + without being referenced.. */ + i_stream_close(client->input); + } } static void client_check_idle(struct pop3_client *client)