Fix tkldb crash, had to do with stealing references.

diff --git a/src/modules/tkldb.c b/src/modules/tkldb.c
index 5f6141076e485dca028431b9b8c7c7ce90bd3937..ccbfd6601724548f142faec771256f71b855a7c3 100644 (file)
--- a/src/modules/tkldb.c
+++ b/src/modules/tkldb.c
@@ -731,10 +731,16 @@ int read_tkldb(void)
                                                   tkl->ptr.spamfilter->tkl_duration,
                                                   tkl->ptr.spamfilter->tkl_reason,
                                                   0);
-                               /* tkl_add_spamfilter() does not copy the match but assign it.
-                                * so set to NULL here to avoid a read-after-free later on.
+                               /* Further down in the code we free fields of the TKL entry,
+                                * this is generally fine since almost all fields are copied
+                                * by tkl_add_spamfilter(), however some are not.
+                                * For the following types tkl_add_spamfilter() actually
+                                * steals the reference, instead of duplicating,
+                                * so we have to set them to NULL here:
                                 */
                                tkl->ptr.spamfilter->match = NULL;
+                               tkl->ptr.spamfilter->except = NULL;
+                               tkl->ptr.spamfilter->action = NULL;
                        }
                } else
                {