diff options
| author | Gerald Carter <jerry@samba.org> | 2006-01-23 14:02:17 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 11:06:12 -0500 |
| commit | e95e6044b06fa225b016f20ab53ee4082a8f5ae0 (patch) | |
| tree | addd59df620708bae48493859d49322dd9c3ea2f /source3/nmbd | |
| parent | 2f7bc0e53d369fa687cc5ffb144fa262ac418e3a (diff) | |
| download | samba-e95e6044b06fa225b016f20ab53ee4082a8f5ae0.tar.gz samba-e95e6044b06fa225b016f20ab53ee4082a8f5ae0.tar.bz2 samba-e95e6044b06fa225b016f20ab53ee4082a8f5ae0.zip | |
r13081: correct fix for the segv in nmbd caused by a double free on namerec.
(This used to be commit c908dbc4b260bac72cbc6d25f4728359a6ec8259)
Diffstat (limited to 'source3/nmbd')
| -rw-r--r-- | source3/nmbd/nmbd_namelistdb.c | 11 | ||||
| -rw-r--r-- | source3/nmbd/nmbd_winsserver.c | 5 |
2 files changed, 8 insertions, 8 deletions
diff --git a/source3/nmbd/nmbd_namelistdb.c b/source3/nmbd/nmbd_namelistdb.c index baaf5dbd54..60023a7ed5 100644 --- a/source3/nmbd/nmbd_namelistdb.c +++ b/source3/nmbd/nmbd_namelistdb.c @@ -80,14 +80,13 @@ static void upcase_name( struct nmb_name *target, const struct nmb_name *source void remove_name_from_namelist(struct subnet_record *subrec, struct name_record *namerec ) { - if (subrec == wins_server_subnet) { + if (subrec == wins_server_subnet) remove_name_from_wins_namelist(namerec); - return; - } - - subrec->namelist_changed = True; + else { + subrec->namelist_changed = True; + DLIST_REMOVE(subrec->namelist, namerec); + } - DLIST_REMOVE(subrec->namelist, namerec); SAFE_FREE(namerec->data.ip); ZERO_STRUCTP(namerec); SAFE_FREE(namerec); diff --git a/source3/nmbd/nmbd_winsserver.c b/source3/nmbd/nmbd_winsserver.c index 5c234bf8dc..9983efe5eb 100644 --- a/source3/nmbd/nmbd_winsserver.c +++ b/source3/nmbd/nmbd_winsserver.c @@ -290,8 +290,9 @@ BOOL remove_name_from_wins_namelist(struct name_record *namerec) DLIST_REMOVE(wins_server_subnet->namelist, namerec); SAFE_FREE(namerec->data.ip); - ZERO_STRUCTP(namerec); - SAFE_FREE(namerec); + + /* namerec must be freed by the caller */ + return (ret == 0) ? True : False; } |