summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrew Tridgell <tridge@samba.org>2007-05-21 23:35:14 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 14:52:45 -0500
commit31f047f734d763ac6661f33afae8f39cf2fd4bd4 (patch)
tree4c3f11d1b63e1b699b98a0f6c25ce5322af9e6ca
parent4378af38ec9fcf2bd848355123f22d7a67130f9b (diff)
downloadsamba-31f047f734d763ac6661f33afae8f39cf2fd4bd4.tar.gz
samba-31f047f734d763ac6661f33afae8f39cf2fd4bd4.tar.bz2
samba-31f047f734d763ac6661f33afae8f39cf2fd4bd4.zip
r23057: only call the async recv function for the first pending receive, not
all pending receives, when the transport dies. This is because the async callback most commonly shuts down the connection (it's the only reasonable thing to do when it's dead), and that frees the whole context. That means that if we loop more than once, we'll end up using freed memory. (This used to be commit 75d537d3a5e3fc5258ce48bfec0c0ce6160978f6)
-rw-r--r--source4/libcli/raw/clitransport.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/source4/libcli/raw/clitransport.c b/source4/libcli/raw/clitransport.c
index 8c4c7f7c43..ea2aa880b6 100644
--- a/source4/libcli/raw/clitransport.c
+++ b/source4/libcli/raw/clitransport.c
@@ -138,8 +138,11 @@ void smbcli_transport_dead(struct smbcli_transport *transport, NTSTATUS status)
status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
}
- /* kill all pending receives */
- while (transport->pending_recv) {
+ /* kill only the first pending receive - this is so that if
+ that async function frees the connection we don't die trying
+ to use old memory. The caller has to cope with only one
+ network error */
+ if (transport->pending_recv) {
struct smbcli_request *req = transport->pending_recv;
req->state = SMBCLI_REQUEST_ERROR;
req->status = status;