summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrew Tridgell <tridge@samba.org>2010-09-10 20:15:51 +1000
committerAndrew Tridgell <tridge@samba.org>2010-09-15 15:39:33 +1000
commitd00cb8b3d311a694369e3a9a627ab7d6bc534c4b (patch)
treee91b69504e7ee1604225fb3f12a541a593362fc7
parent597372df34ba48b96e5c9cad4d552ce1b932b66e (diff)
downloadsamba-d00cb8b3d311a694369e3a9a627ab7d6bc534c4b.tar.gz
samba-d00cb8b3d311a694369e3a9a627ab7d6bc534c4b.tar.bz2
samba-d00cb8b3d311a694369e3a9a627ab7d6bc534c4b.zip
s4-dsdb: fixed use after free for RODC
-rw-r--r--source4/dsdb/samdb/ldb_modules/repl_meta_data.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
index 160f60f18c..5815e9158d 100644
--- a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+++ b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
@@ -2176,13 +2176,12 @@ static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
ret = replmd_update_rpmd(module, ac->schema, req, msg, &ac->seq_num, t, &is_urgent);
if (ret == LDB_ERR_REFERRAL) {
- talloc_free(ac);
-
referral = talloc_asprintf(req,
"ldap://%s/%s",
lpcfg_dnsdomain(lp_ctx),
ldb_dn_get_linearized(msg->dn));
ret = ldb_module_send_referral(req, referral);
+ talloc_free(ac);
return ldb_module_done(req, NULL, NULL, ret);
}