Disengaging imsgev is tricky. First imsgev_clear as we know there

isn't anything left to be written. Signal imsgev termination by
setting iev->terminate = 1(Mind that we are setting it from with
the callback). As imsgev would again callback dispatch with
IMSGEV_DONE, we cannot free imsgev yet. So iev_maildrop need to
exist beyond lifetime of session until IMSGEV_DONE. Allocating it
seperately from session.

imsgev_close is avoided as it schedules another EV_WRITE which is
not needed in our case.

This fixes a crash observed consistently with a little perl script
to simulate concurrent sessions. Thanks MALLOC_OPTIONS='SFG<<'

1 files changed, 1 insertions, 1 deletions

diff --git a/pop3d.h b/pop3d.h
index 1b70163..fa7de0b 100644
--- a/pop3d.h
+++ b/pop3d.h
@@ -129,7 +129,7 @@ enum state {
 
 struct session {
 	SPLAY_ENTRY(session)	entry;
-	struct imsgev		iev_maildrop;
+	struct imsgev		*iev_maildrop;
 	struct iobuf		iobuf;
 	struct io		io;
 	char			user[ARGLEN];