dovecot-2.2: ioloop: Fixed segfault crash in io_loop_call_pendin...

[dovecot at dovecot.org]

details:   http://hg.dovecot.org/dovecot-2.2/rev/7540a5cdbdf1
changeset: 17243:7540a5cdbdf1
user:      Timo Sirainen <tss at iki.fi>
date:      Sat Apr 19 11:07:45 2014 +0200
description:
ioloop: Fixed segfault crash in io_loop_call_pending().
When a callback called io_set_pending(), the io_loop_call_pending() loop
crossed the end of the ioloop->io_files list.

Based on patch by Stephan Bosch

diffstat:

 src/lib/ioloop.c |  15 ++++++++++-----
 1 files changed, 10 insertions(+), 5 deletions(-)

diffs (25 lines):

diff -r cba90b79fa48 -r 7540a5cdbdf1 src/lib/ioloop.c
--- a/src/lib/ioloop.c	Thu Apr 17 16:42:02 2014 +0200
+++ b/src/lib/ioloop.c	Sat Apr 19 11:07:45 2014 +0200
@@ -470,11 +470,16 @@
 {
 	struct io_file *io;
 
-	for (io = ioloop->io_files; ioloop->io_pending_count > 0; ) {
-		ioloop->next_io_file = io->next;
-		if (io->io.pending)
-			io_loop_call_io(&io->io);
-		io = ioloop->next_io_file;
+	while (ioloop->io_pending_count > 0) {
+		io = ioloop->io_files;
+		do {
+			ioloop->next_io_file = io->next;
+			if (io->io.pending)
+				io_loop_call_io(&io->io);
+			if (ioloop->io_pending_count == 0)
+				break;
+			io = ioloop->next_io_file;
+		} while (io != NULL);
 	}
 }