diff options
| author | Charles Longeau <chl@cvs.openbsd.org> | 2012-08-11 19:19:20 +0000 |
|---|---|---|
| committer | Charles Longeau <chl@cvs.openbsd.org> | 2012-08-11 19:19:20 +0000 |
| commit | b834061e3bd445178ce8d3a4d43ab81b29a6ca43 (patch) | |
| tree | 972413796618a78724c186ada886a8b053efc1c1 /usr.sbin | |
| parent | ea0e3d94b6389b7150758021e18dfc6422b1f474 (diff) | |
fix use after free
ok eric@
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/smtpd/scheduler_ramqueue.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/usr.sbin/smtpd/scheduler_ramqueue.c b/usr.sbin/smtpd/scheduler_ramqueue.c index 07717fcd616..1630d6e5cb2 100644 --- a/usr.sbin/smtpd/scheduler_ramqueue.c +++ b/usr.sbin/smtpd/scheduler_ramqueue.c @@ -1,4 +1,4 @@ -/* $OpenBSD: scheduler_ramqueue.c,v 1.12 2012/08/08 08:50:42 eric Exp $ */ +/* $OpenBSD: scheduler_ramqueue.c,v 1.13 2012/08/11 19:19:19 chl Exp $ */ /* * Copyright (c) 2012 Gilles Chehade <gilles@openbsd.org> @@ -604,6 +604,7 @@ rq_envelope_delete(struct rq_queue *rq, struct rq_envelope *envelope) struct rq_message *message; struct rq_batch *batch; struct rq_host *host; + uint32_t msgid; if (envelope->flags & RQ_ENVELOPE_EXPIRED) tree_pop(&rq->expired, envelope->evpid); @@ -611,17 +612,18 @@ rq_envelope_delete(struct rq_queue *rq, struct rq_envelope *envelope) TAILQ_REMOVE(envelope->queue, envelope, entry); batch = envelope->batch; message = envelope->message; + msgid = message->msgid; host = batch->host; tree_xpop(&message->envelopes, envelope->evpid); if (tree_empty(&message->envelopes)) { - tree_xpop(&rq->messages, message->msgid); + tree_xpop(&rq->messages, msgid); free(message); } tree_xpop(&batch->envelopes, envelope->evpid); if (tree_empty(&batch->envelopes)) { - tree_xpop(&host->batches, message->msgid); + tree_xpop(&host->batches, msgid); if (tree_empty(&host->batches)) { SPLAY_REMOVE(hosttree, &rq->hosts, host); free(host); |