[evolution-data-server] Bug #632532 - Double free in imapx_job_done, imapx_command_step_fetch_done

[Milan Crha <mcrha src gnome org>]

commit 5c6065abfdcb1b43748f086cfe071e5c48e76515
Author: Milan Crha <mcrha redhat com>
Date:   Wed Nov 3 14:08:29 2010 +0100

    Bug #632532 - Double free in imapx_job_done, imapx_command_step_fetch_done

 camel/providers/imapx/camel-imapx-server.c |   83 +++++++++++++++++++++-------
 1 files changed, 63 insertions(+), 20 deletions(-)
---
diff --git a/camel/providers/imapx/camel-imapx-server.c b/camel/providers/imapx/camel-imapx-server.c
index 246b9bb..f60fc5a 100644
--- a/camel/providers/imapx/camel-imapx-server.c
+++ b/camel/providers/imapx/camel-imapx-server.c
@@ -2173,8 +2173,10 @@ imapx_command_idle_done (CamelIMAPXServer *is,
 			g_set_error (
 				&ic->job->error, CAMEL_IMAPX_ERROR, 1,
 				"Error performing IDLE: %s", ic->status->text);
-		else
+		else {
 			g_propagate_error (&ic->job->error, ic->error);
+			ic->error = NULL;
+		}
 	}
 
 	IDLE_LOCK (idle);
@@ -2477,9 +2479,10 @@ imapx_command_select_done (CamelIMAPXServer *is, CamelIMAPXCommand *ic)
 			while (cn) {
 				if (ic->status)
 					cw->status = imapx_copy_status (ic->status);
-				if (ic->error != NULL)
+				if (ic->error != NULL) {
 					g_propagate_error (&cw->error, ic->error);
-				else
+					ic->error = NULL;
+				} else
 					g_set_error (
 						&cw->error, CAMEL_IMAPX_ERROR, 1,
 						"SELECT %s failed: %s",
@@ -2906,8 +2909,10 @@ imapx_connect_to_server (CamelIMAPXServer *is,
 					error, CAMEL_ERROR,
 					CAMEL_ERROR_GENERIC,
 					"%s", ic->status->text);
-			else
+			else {
 				g_propagate_error (error, ic->error);
+				ic->error = NULL;
+			}
 
 			camel_imapx_command_free (ic);
 			return FALSE;
@@ -2939,8 +2944,10 @@ imapx_connect_to_server (CamelIMAPXServer *is,
 					&local_error, CAMEL_ERROR,
 					CAMEL_ERROR_GENERIC,
 					"%s", ic->status->text);
-			else
+			else {
 				g_propagate_error (&local_error, ic->error);
+				ic->error = NULL;
+			}
 
 			camel_imapx_command_free (ic);
 			goto exit;
@@ -2972,6 +2979,7 @@ imapx_connect_to_server (CamelIMAPXServer *is,
 				cancellable, "CAPABILITY");
 			if (!imapx_command_run (is, ic)) {
 				g_propagate_error (&local_error, ic->error);
+				ic->error = NULL;
 				camel_imapx_command_free (ic);
 				goto exit;
 			}
@@ -2986,6 +2994,7 @@ exit:
 		e(is->tagprefix, "Unable to connect %d %s \n",
 		  local_error->code, local_error->message);
 		g_propagate_error (error, local_error);
+		local_error = NULL;
 		g_object_unref (is->stream);
 		is->stream = NULL;
 
@@ -3115,6 +3124,7 @@ imapx_reconnect (CamelIMAPXServer *is,
 			    set with the error message */
 			if (ic->error != NULL) {
 				g_propagate_error (error, ic->error);
+				ic->error = NULL;
 				camel_imapx_command_free (ic);
 				goto exception;
 			}
@@ -3134,6 +3144,7 @@ imapx_reconnect (CamelIMAPXServer *is,
 			cancellable, "CAPABILITY");
 		if (!imapx_command_run (is, ic)) {
 			g_propagate_error (error, ic->error);
+			ic->error = NULL;
 			camel_imapx_command_free (ic);
 			goto exception;
 		}
@@ -3159,6 +3170,7 @@ imapx_reconnect (CamelIMAPXServer *is,
 			cancellable, "NAMESPACE");
 		if (!imapx_command_run (is, ic)) {
 			g_propagate_error (error, ic->error);
+			ic->error = NULL;
 			camel_imapx_command_free (ic);
 			goto exception;
 		}
@@ -3173,6 +3185,7 @@ imapx_reconnect (CamelIMAPXServer *is,
 			"ENABLE CONDSTORE QRESYNC");
 		if (!imapx_command_run (is, ic)) {
 			g_propagate_error (error, ic->error);
+			ic->error = NULL;
 			camel_imapx_command_free (ic);
 			goto exception;
 		}
@@ -3274,8 +3287,10 @@ imapx_command_fetch_message_done (CamelIMAPXServer *is, CamelIMAPXCommand *ic)
 				g_set_error (
 					&job->error, CAMEL_IMAPX_ERROR, 1,
 					"Error fetching message: %s", ic->status->text);
-			else
+			else {
 				g_propagate_error (&job->error, ic->error);
+				ic->error = NULL;
+			}
 			g_object_unref (stream);
 			job->u.get_message.stream = NULL;
 		} else {
@@ -3398,8 +3413,10 @@ imapx_command_copy_messages_step_done (CamelIMAPXServer *is,
 			g_set_error (
 				&job->error, CAMEL_IMAPX_ERROR, 1,
 				"Error copying messages");
-		else
+		else {
 			g_propagate_error (&job->error, ic->error);
+			ic->error = NULL;
+		}
 
 		goto cleanup;
 	}
@@ -3505,8 +3522,10 @@ imapx_command_append_message_done (CamelIMAPXServer *is,
 			g_set_error (
 				&job->error, CAMEL_IMAPX_ERROR, 1,
 				"Error appending message: %s", ic->status->text);
-		else
+		else {
 			g_propagate_error (&job->error, ic->error);
+			ic->error = NULL;
+		}
 	}
 
 	camel_data_cache_remove (ifolder->cache, "new", old_uid, NULL);
@@ -3618,8 +3637,10 @@ imapx_command_step_fetch_done (CamelIMAPXServer *is,
 			g_set_error (
 				&job->error, CAMEL_IMAPX_ERROR, 1,
 				"Error fetching message headers");
-		else
+		else {
 			g_propagate_error (&job->error, ic->error);
+			ic->error = NULL;
+		}
 
 		goto cleanup;
 	}
@@ -3868,8 +3889,10 @@ imapx_job_scan_changes_done (CamelIMAPXServer *is,
 			g_set_error (
 				&job->error, CAMEL_IMAPX_ERROR, 1,
 				"Error retriving message: %s", ic->status->text);
-		else
+		else {
 			g_propagate_error (&job->error, ic->error);
+			ic->error = NULL;
+		}
 	}
 
 	for (i=0;i<infos->len;i++) {
@@ -3921,8 +3944,10 @@ imapx_command_fetch_new_messages_done (CamelIMAPXServer *is,
 			g_set_error (
 				&ic->job->error, CAMEL_IMAPX_ERROR, 1,
 				"Error fetching new messages: %s", ic->status->text);
-		else
+		else {
 			g_propagate_error (&ic->job->error, ic->error);
+			ic->error = NULL;
+		}
 		goto exception;
 	}
 
@@ -4092,8 +4117,10 @@ imapx_job_refresh_info_start (CamelIMAPXServer *is,
 					g_set_error (
 						&job->error, CAMEL_IMAPX_ERROR, 1,
 						"Error refreshing folder: %s", ic->status->text);
-				else
+				else {
 					g_propagate_error (&job->error, ic->error);
+					ic->error = NULL;
+				}
 
 				camel_imapx_command_free (ic);
 				goto done;
@@ -4180,8 +4207,10 @@ imapx_command_expunge_done (CamelIMAPXServer *is,
 			g_set_error (
 				&ic->job->error, CAMEL_IMAPX_ERROR, 1,
 				"Error expunging message: %s", ic->status->text);
-		else
+		else {
 			g_propagate_error (&ic->job->error, ic->error);
+			ic->error = NULL;
+		}
 	} else {
 		GPtrArray *uids;
 		CamelFolder *folder = ic->job->folder;
@@ -4260,8 +4289,10 @@ imapx_command_list_done (CamelIMAPXServer *is,
 			g_set_error (
 				&ic->job->error, CAMEL_IMAPX_ERROR, 1,
 				"Error fetching folders: %s", ic->status->text);
-		else
+		else {
 			g_propagate_error (&ic->job->error, ic->error);
+			ic->error = NULL;
+		}
 	}
 
 	e (is->tagprefix, "==== list or lsub completed ==== \n");
@@ -4317,8 +4348,10 @@ imapx_command_subscription_done (CamelIMAPXServer *is,
 			g_set_error (
 				&ic->job->error, CAMEL_IMAPX_ERROR, 1,
 				"Error subscribing to folder : %s", ic->status->text);
-		else
+		else {
 			g_propagate_error (&ic->job->error, ic->error);
+			ic->error = NULL;
+		}
 	}
 
 	imapx_job_done (is, ic->job);
@@ -4364,8 +4397,10 @@ imapx_command_create_folder_done (CamelIMAPXServer *is,
 			g_set_error (
 				&ic->job->error, CAMEL_IMAPX_ERROR, 1,
 				"Error creating to folder: %s", ic->status->text);
-		else
+		else {
 			g_propagate_error (&ic->job->error, ic->error);
+			ic->error = NULL;
+		}
 	}
 
 	imapx_job_done (is, ic->job);
@@ -4402,8 +4437,10 @@ imapx_command_delete_folder_done (CamelIMAPXServer *is,
 			g_set_error (
 				&ic->job->error, CAMEL_IMAPX_ERROR, 1,
 				"Error deleting to folder : %s", ic->status->text);
-		else
+		else {
 			g_propagate_error (&ic->job->error, ic->error);
+			ic->error = NULL;
+		}
 	}
 
 	imapx_job_done (is, ic->job);
@@ -4445,8 +4482,10 @@ imapx_command_rename_folder_done (CamelIMAPXServer *is,
 			g_set_error (
 				&ic->job->error, CAMEL_IMAPX_ERROR, 1,
 				"Error renaming to folder: %s", ic->status->text);
-		else
+		else {
 			g_propagate_error (&ic->job->error, ic->error);
+			ic->error = NULL;
+		}
 	}
 
 	imapx_job_done (is, ic->job);
@@ -4489,8 +4528,10 @@ imapx_command_noop_done (CamelIMAPXServer *is,
 			g_set_error (
 				&ic->job->error, CAMEL_IMAPX_ERROR, 1,
 				"Error performing NOOP: %s", ic->status->text);
-		else
+		else {
 			g_propagate_error (&ic->job->error, ic->error);
+			ic->error = NULL;
+		}
 	}
 
 	imapx_job_done (is, ic->job);
@@ -4570,8 +4611,10 @@ imapx_command_sync_changes_done (CamelIMAPXServer *is, CamelIMAPXCommand *ic)
 				g_set_error (
 					&job->error, CAMEL_IMAPX_ERROR, 1,
 					"Error syncing changes: %s", ic->status->text);
-			else
+			else {
 				g_propagate_error (&job->error, ic->error);
+				ic->error = NULL;
+			}
 		} else if (ic->error) {
 			g_clear_error (&ic->error);
 		}