summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorVolker Lendecke <vl@samba.org>2010-07-06 15:07:05 +0200
committerVolker Lendecke <vl@samba.org>2010-07-06 15:11:31 +0200
commitb4c3f72d445a5659971b0080ab1eba88695d2a0d (patch)
tree923d5c7d1a535b89f2a61f80ed92ea9fbe2fb676
parent60a3cc850a27a14110541439c05387efb0312210 (diff)
downloadsamba-b4c3f72d445a5659971b0080ab1eba88695d2a0d.tar.gz
samba-b4c3f72d445a5659971b0080ab1eba88695d2a0d.tar.bz2
samba-b4c3f72d445a5659971b0080ab1eba88695d2a0d.zip
s3: Fix a segfault in the RPC server
After converting the rpc infratructure to talloc, read_from_internal_pipe freed the outdata too early. If the last fragment was read in two pieces (as rpcclient does it), all the outdata was freed during the read of the first piece of the read of the last fragment. Later read&x calls, trying to read the rest of the last fragment stepped into p->out_data.frag with non-zero offset when this was already freed.
-rw-r--r--source3/rpc_server/srv_pipe_hnd.c17
1 files changed, 9 insertions, 8 deletions
diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c
index a77b9eabc0..e9339929df 100644
--- a/source3/rpc_server/srv_pipe_hnd.c
+++ b/source3/rpc_server/srv_pipe_hnd.c
@@ -858,15 +858,16 @@ static ssize_t read_from_internal_pipe(struct pipes_struct *p, char *data,
* current_pdu_sent. */
p->out_data.current_pdu_sent = 0;
prs_mem_free(&p->out_data.frag);
- }
- if(p->out_data.data_sent_length >= prs_offset(&p->out_data.rdata)) {
- /*
- * We're completely finished with both outgoing and
- * incoming data streams. It's safe to free all temporary
- * data from this request.
- */
- free_pipe_context(p);
+ if (p->out_data.data_sent_length
+ >= prs_offset(&p->out_data.rdata)) {
+ /*
+ * We're completely finished with both outgoing and
+ * incoming data streams. It's safe to free all
+ * temporary data from this request.
+ */
+ free_pipe_context(p);
+ }
}
return data_returned;