summaryrefslogtreecommitdiff
path: root/source3/nmbd
diff options
context:
space:
mode:
authorGerald Carter <jerry@samba.org>2006-01-23 14:02:17 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 11:06:12 -0500
commite95e6044b06fa225b016f20ab53ee4082a8f5ae0 (patch)
treeaddd59df620708bae48493859d49322dd9c3ea2f /source3/nmbd
parent2f7bc0e53d369fa687cc5ffb144fa262ac418e3a (diff)
downloadsamba-e95e6044b06fa225b016f20ab53ee4082a8f5ae0.tar.gz
samba-e95e6044b06fa225b016f20ab53ee4082a8f5ae0.tar.bz2
samba-e95e6044b06fa225b016f20ab53ee4082a8f5ae0.zip
r13081: correct fix for the segv in nmbd caused by a double free on namerec.
(This used to be commit c908dbc4b260bac72cbc6d25f4728359a6ec8259)
Diffstat (limited to 'source3/nmbd')
-rw-r--r--source3/nmbd/nmbd_namelistdb.c11
-rw-r--r--source3/nmbd/nmbd_winsserver.c5
2 files changed, 8 insertions, 8 deletions
diff --git a/source3/nmbd/nmbd_namelistdb.c b/source3/nmbd/nmbd_namelistdb.c
index baaf5dbd54..60023a7ed5 100644
--- a/source3/nmbd/nmbd_namelistdb.c
+++ b/source3/nmbd/nmbd_namelistdb.c
@@ -80,14 +80,13 @@ static void upcase_name( struct nmb_name *target, const struct nmb_name *source
void remove_name_from_namelist(struct subnet_record *subrec,
struct name_record *namerec )
{
- if (subrec == wins_server_subnet) {
+ if (subrec == wins_server_subnet)
remove_name_from_wins_namelist(namerec);
- return;
- }
-
- subrec->namelist_changed = True;
+ else {
+ subrec->namelist_changed = True;
+ DLIST_REMOVE(subrec->namelist, namerec);
+ }
- DLIST_REMOVE(subrec->namelist, namerec);
SAFE_FREE(namerec->data.ip);
ZERO_STRUCTP(namerec);
SAFE_FREE(namerec);
diff --git a/source3/nmbd/nmbd_winsserver.c b/source3/nmbd/nmbd_winsserver.c
index 5c234bf8dc..9983efe5eb 100644
--- a/source3/nmbd/nmbd_winsserver.c
+++ b/source3/nmbd/nmbd_winsserver.c
@@ -290,8 +290,9 @@ BOOL remove_name_from_wins_namelist(struct name_record *namerec)
DLIST_REMOVE(wins_server_subnet->namelist, namerec);
SAFE_FREE(namerec->data.ip);
- ZERO_STRUCTP(namerec);
- SAFE_FREE(namerec);
+
+ /* namerec must be freed by the caller */
+
return (ret == 0) ? True : False;
}