summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStefan Metzmacher <metze@samba.org>2005-11-10 09:12:36 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 13:46:03 -0500
commit7118df6df0970ce3403056a2ee073c18d0b06bd7 (patch)
tree87f73683affd2f653260749b350287d5eb6f4afa
parent62346e2b656c256110918004d4fd8db140afa238 (diff)
downloadsamba-7118df6df0970ce3403056a2ee073c18d0b06bd7.tar.gz
samba-7118df6df0970ce3403056a2ee073c18d0b06bd7.tar.bz2
samba-7118df6df0970ce3403056a2ee073c18d0b06bd7.zip
r11635: fix a handling of packet_send in the smb client lib
this was cause of the PANIC on the build farm on metze01 as we use req->out.buffer from the old request in the smb_raw_ntcancel() and send a 0 TID, that causes our server code to crash (a fix for the server code will follow) metze (This used to be commit 97cd824e44b03178706b108c7a78753faf412e8f)
-rw-r--r--source4/libcli/raw/clitransport.c11
1 files changed, 10 insertions, 1 deletions
diff --git a/source4/libcli/raw/clitransport.c b/source4/libcli/raw/clitransport.c
index bc00b19ef5..6bf79ecfb0 100644
--- a/source4/libcli/raw/clitransport.c
+++ b/source4/libcli/raw/clitransport.c
@@ -559,7 +559,16 @@ void smbcli_transport_send(struct smbcli_request *req)
return;
}
- /* put it on the socket queue */
+ /* put it on the socket queue
+ * - as the buffer is a part of the smbcli_request struct
+ * we need to reference it here, because packet_queue_run()
+ * will call talloc_free() on it
+ */
+ if (!talloc_reference(req, req->out.buffer)) {
+ req->state = SMBCLI_REQUEST_ERROR;
+ req->status = NT_STATUS_NO_MEMORY;
+ return;
+ }
blob = data_blob_const(req->out.buffer, req->out.size);
status = packet_send(req->transport->packet, blob);
if (!NT_STATUS_IS_OK(status)) {