Bug 719720 - Refcount error in imapx_command_select_done()

We were finalizing the CamelIMAPXCommand too early, and then trying
to use it further down in the logic.  This of course led to crashes.

Failed command structures were also leaking.  Fixed that too.

1 files changed, 13 insertions, 6 deletions

diff --git a/camel/camel-imapx-server.c b/camel/camel-imapx-server.c
index 5cf5dec21..dedbb4a05 100644
--- a/camel/camel-imapx-server.c
+++ b/camel/camel-imapx-server.c
@@ -3496,10 +3496,10 @@ imapx_command_select_done (CamelIMAPXServer *is,
 	g_return_if_fail (CAMEL_IS_IMAPX_JOB (job));
 
 	if (camel_imapx_command_set_error_if_failed (ic, &local_error)) {
-		GQueue failed = G_QUEUE_INIT;
+		CamelIMAPXCommandQueue *failed;
 		GQueue trash = G_QUEUE_INIT;
 		CamelFolder *folder;
-		GList *link;
+		GList *list, *link;
 
 		c (is->tagprefix, "Select failed\n");
 
@@ -3510,6 +3510,8 @@ imapx_command_select_done (CamelIMAPXServer *is,
 		is->state = IMAPX_INITIALISED;
 		g_mutex_unlock (&is->priv->select_lock);
 
+		failed = camel_imapx_command_queue_new ();
+
 		QUEUE_LOCK (is);
 
 		if (folder != NULL) {
@@ -3534,17 +3536,20 @@ imapx_command_select_done (CamelIMAPXServer *is,
 
 		while ((link = g_queue_pop_head (&trash)) != NULL) {
 			CamelIMAPXCommand *cw = link->data;
+			camel_imapx_command_ref (cw);
 			camel_imapx_command_queue_delete_link (is->queue, link);
-			g_queue_push_tail (&failed, cw);
+			camel_imapx_command_queue_push_tail (failed, cw);
+			camel_imapx_command_unref (cw);
 		}
 
 		QUEUE_UNLOCK (is);
 
-		while (!g_queue_is_empty (&failed)) {
-			CamelIMAPXCommand *cw;
+		list = camel_imapx_command_queue_peek_head_link (failed);
+
+		for (link = list; link != NULL; link = g_list_next (link)) {
+			CamelIMAPXCommand *cw = link->data;
 			CamelIMAPXJob *failed_job;
 
-			cw = g_queue_pop_head (&failed);
 			failed_job = camel_imapx_command_get_job (cw);
 
 			if (!CAMEL_IS_IMAPX_JOB (failed_job)) {
@@ -3560,6 +3565,8 @@ imapx_command_select_done (CamelIMAPXServer *is,
 			cw->complete (is, cw);
 		}
 
+		camel_imapx_command_queue_free (failed);
+
 		camel_imapx_job_take_error (job, local_error);
 		imapx_unregister_job (is, job);