diff options
| author | Andrew Tridgell <tridge@samba.org> | 2004-09-25 08:08:12 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 12:59:12 -0500 |
| commit | 69d170e7238769284d5bb69bf552791ff8bc0148 (patch) | |
| tree | 6c003cd89b4763dfbd88cd5f7f3a4bcc0500b470 | |
| parent | e3e3e4577bf7d4c8570c23ed994c3f4e49c2b0c3 (diff) | |
| download | samba-69d170e7238769284d5bb69bf552791ff8bc0148.tar.gz samba-69d170e7238769284d5bb69bf552791ff8bc0148.tar.bz2 samba-69d170e7238769284d5bb69bf552791ff8bc0148.zip | |
r2616: the cascading nature of talloc_free() can lead to some surprises. In
this case the bug was that server_terminate_connection() destroys the
server context, which in turn cascades down to destroy all current
request contexts, so we musn't then try to destroy the request
structure a second time.
(This used to be commit 28a647f681e2166c01f7ac59b16305676d5caa71)
| -rw-r--r-- | source4/smb_server/request.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/source4/smb_server/request.c b/source4/smb_server/request.c index e3121f8398..15e821b32b 100644 --- a/source4/smb_server/request.c +++ b/source4/smb_server/request.c @@ -261,6 +261,7 @@ void req_send_reply_nosign(struct smbsrv_request *req) status = socket_send(req->smb_conn->connection->socket, req, &tmp_blob, &sendlen, SOCKET_FLAG_BLOCK); if (!NT_STATUS_IS_OK(status) || (req->out.size != sendlen)) { smbsrv_terminate_connection(req->smb_conn, "failed to send reply\n"); + return; } req_destroy(req); |