[evolution-data-server] Fix some crashes in imapx_command_start_next().



commit 7efd1e7969c70fb497febd455591041994bbf90b
Author: Matthew Barnes <mbarnes redhat com>
Date:   Fri Mar 16 15:30:32 2012 -0400

    Fix some crashes in imapx_command_start_next().
    
    Start the next CamelIMAPXCommand before unreferencing the current one.
    
    imapx_command_start() calls camel_imapx_command_close() on the current
    command before initiating the next command, but imapx_command_start()
    is being handed a potentially dangling CamelIMAPXCommand pointer.
    
    This is most certainly causing of all the camel_imapx_command_close()
    crashes, and likely a good number of memory corruption crashes as well.

 camel/providers/imapx/camel-imapx-server.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)
---
diff --git a/camel/providers/imapx/camel-imapx-server.c b/camel/providers/imapx/camel-imapx-server.c
index eb50101..13a4bc1 100644
--- a/camel/providers/imapx/camel-imapx-server.c
+++ b/camel/providers/imapx/camel-imapx-server.c
@@ -637,8 +637,8 @@ imapx_command_start_next (CamelIMAPXServer *is,
 		/* Start the tagged commands. */
 		while ((link = g_queue_pop_head (&start)) != NULL) {
 			CamelIMAPXCommand *ic = link->data;
-			camel_imapx_command_queue_delete_link (is->queue, link);
 			imapx_command_start (is, ic, cancellable, error);
+			camel_imapx_command_queue_delete_link (is->queue, link);
 		}
 
 		return;
@@ -727,8 +727,8 @@ imapx_command_start_next (CamelIMAPXServer *is,
 		/* Start the tagged commands. */
 		while ((link = g_queue_pop_head (&start)) != NULL) {
 			CamelIMAPXCommand *ic = link->data;
-			camel_imapx_command_queue_delete_link (is->queue, link);
 			imapx_command_start (is, ic, cancellable, error);
+			camel_imapx_command_queue_delete_link (is->queue, link);
 			commands_started = TRUE;
 		}
 
@@ -778,8 +778,8 @@ imapx_command_start_next (CamelIMAPXServer *is,
 		/* Start the tagged commands. */
 		while ((link = g_queue_pop_head (&start)) != NULL) {
 			CamelIMAPXCommand *ic = link->data;
-			camel_imapx_command_queue_delete_link (is->queue, link);
 			imapx_command_start (is, ic, cancellable, error);
+			camel_imapx_command_queue_delete_link (is->queue, link);
 		}
 	}
 }



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]