[CritFix] Fix leak of shared memory fds and files

diff --git a/src/libutil/http.c b/src/libutil/http.c
index 0536da453ae4be5a3d9780713a41884a959b4e4b..b87e02f15b78c45e43acb832e1e1cf42e6e6a02e 100644 (file)
--- a/src/libutil/http.c
+++ b/src/libutil/http.c
@@ -2360,34 +2360,35 @@ rspamd_http_message_storage_cleanup (struct rspamd_http_message *msg)
        union _rspamd_storage_u *storage;
        struct stat st;
 
-       if (msg->body_buf.len != 0) {
-               if (msg->flags & RSPAMD_HTTP_FLAG_SHMEM) {
-                       storage = &msg->body_buf.c;
-
-                       if (storage->shared.shm_fd != -1) {
-                               g_assert (fstat (storage->shared.shm_fd, &st) != -1);
+       if (msg->flags & RSPAMD_HTTP_FLAG_SHMEM) {
+               storage = &msg->body_buf.c;
 
-                               if (msg->body_buf.str != MAP_FAILED) {
-                                       munmap (msg->body_buf.str, st.st_size);
-                               }
+               if (storage->shared.shm_fd != -1) {
+                       g_assert (fstat (storage->shared.shm_fd, &st) != -1);
 
-                               close (storage->shared.shm_fd);
+                       if (msg->body_buf.str != MAP_FAILED) {
+                               munmap (msg->body_buf.str, st.st_size);
                        }
 
-                       if (storage->shared.name != NULL) {
-                               REF_RELEASE (storage->shared.name);
-                       }
+                       close (storage->shared.shm_fd);
+               }
 
-                       storage->shared.shm_fd = -1;
-                       msg->body_buf.str = MAP_FAILED;
+               if (storage->shared.name != NULL) {
+                       REF_RELEASE (storage->shared.name);
                }
-               else {
+
+               storage->shared.shm_fd = -1;
+               msg->body_buf.str = MAP_FAILED;
+       }
+       else {
+               if (msg->body_buf.c.normal) {
                        rspamd_fstring_free (msg->body_buf.c.normal);
-                       msg->body_buf.c.normal = NULL;
                }
 
-               msg->body_buf.len = 0;
+               msg->body_buf.c.normal = NULL;
        }
+
+       msg->body_buf.len = 0;
 }
 
 void