[evolution-data-server] Bug 719720 - Refcount error in imapx_command_select_done()

[Matthew Barnes <mbarnes src gnome org>]

commit c0626e967159ef75d1e882b9b0da2dc96e065aa5
Author: Matthew Barnes <mbarnes redhat com>
Date:   Wed Dec 4 12:14:52 2013 -0500

    Bug 719720 - Refcount error in imapx_command_select_done()
    
    We were finalizing the CamelIMAPXCommand too early, and then trying
    to use it further down in the logic.  This of course led to crashes.
    
    Failed command structures were also leaking.  Fixed that too.

 camel/providers/imapx/camel-imapx-server.c |   19 +++++++++++++------
 1 files changed, 13 insertions(+), 6 deletions(-)
---
diff --git a/camel/providers/imapx/camel-imapx-server.c b/camel/providers/imapx/camel-imapx-server.c
index b745b5b..898dff1 100644
--- a/camel/providers/imapx/camel-imapx-server.c
+++ b/camel/providers/imapx/camel-imapx-server.c
@@ -3844,9 +3844,9 @@ imapx_command_select_done (CamelIMAPXServer *is,
        g_return_if_fail (CAMEL_IS_IMAPX_JOB (job));
 
        if (camel_imapx_command_set_error_if_failed (ic, &local_error)) {
-               GQueue failed = G_QUEUE_INIT;
+               CamelIMAPXCommandQueue *failed;
                GQueue trash = G_QUEUE_INIT;
-               GList *link;
+               GList *list, *link;
 
                c (is->tagprefix, "Select failed\n");
 
@@ -3859,6 +3859,8 @@ imapx_command_select_done (CamelIMAPXServer *is,
                is->state = IMAPX_INITIALISED;
                g_mutex_unlock (&is->priv->select_lock);
 
+               failed = camel_imapx_command_queue_new ();
+
                QUEUE_LOCK (is);
 
                if (select_pending != NULL) {
@@ -3886,17 +3888,20 @@ imapx_command_select_done (CamelIMAPXServer *is,
 
                while ((link = g_queue_pop_head (&trash)) != NULL) {
                        CamelIMAPXCommand *cw = link->data;
+                       camel_imapx_command_ref (cw);
                        camel_imapx_command_queue_delete_link (is->queue, link);
-                       g_queue_push_tail (&failed, cw);
+                       camel_imapx_command_queue_push_tail (failed, cw);
+                       camel_imapx_command_unref (cw);
                }
 
                QUEUE_UNLOCK (is);
 
-               while (!g_queue_is_empty (&failed)) {
-                       CamelIMAPXCommand *cw;
+               list = camel_imapx_command_queue_peek_head_link (failed);
+
+               for (link = list; link != NULL; link = g_list_next (link)) {
+                       CamelIMAPXCommand *cw = link->data;
                        CamelIMAPXJob *failed_job;
 
-                       cw = g_queue_pop_head (&failed);
                        failed_job = camel_imapx_command_get_job (cw);
 
                        if (!CAMEL_IS_IMAPX_JOB (failed_job)) {
@@ -3912,6 +3917,8 @@ imapx_command_select_done (CamelIMAPXServer *is,
                        cw->complete (is, cw);
                }
 
+               camel_imapx_command_queue_free (failed);
+
                camel_imapx_job_take_error (job, local_error);
                imapx_unregister_job (is, job);