First part of fix for bug #7159 - client rpc_transport doesn't cope with bad server data returns.

Ensure that subreq is *always* talloc_free'd in the _done
function, as it has an event timeout attached. If the
read requests look longer than the cli->timeout, then
the timeout fn is called with already freed data.

Jeremy.

1 files changed, 12 insertions, 0 deletions

diff --git a/source3/rpc_client/rpc_transport_sock.c b/source3/rpc_client/rpc_transport_sock.c
index df060e61e9..4ab17dbd8d 100644
--- a/source3/rpc_client/rpc_transport_sock.c
+++ b/source3/rpc_client/rpc_transport_sock.c
@@ -88,15 +88,21 @@ static void rpc_sock_read_done(struct tevent_req *subreq)
 		req, struct rpc_sock_read_state);
 	int err;
 
+	/* We must free subreq in this function as there is
+	  a timer event attached to it. */
+
 	state->received = async_recv_recv(subreq, &err);
+
 	if (state->received == -1) {
 		if (state->transp->fd != -1) {
 			close(state->transp->fd);
 			state->transp->fd = -1;
 		}
+		TALLOC_FREE(subreq);
 		tevent_req_nterror(req, map_nt_error_from_unix(err));
 		return;
 	}
+	TALLOC_FREE(subreq);
 	tevent_req_done(req);
 }
 
@@ -165,15 +171,21 @@ static void rpc_sock_write_done(struct tevent_req *subreq)
 		req, struct rpc_sock_write_state);
 	int err;
 
+	/* We must free subreq in this function as there is
+	  a timer event attached to it. */
+
 	state->sent = async_send_recv(subreq, &err);
+
 	if (state->sent == -1) {
 		if (state->transp->fd != -1) {
 			close(state->transp->fd);
 			state->transp->fd = -1;
 		}
+		TALLOC_FREE(subreq);
 		tevent_req_nterror(req, map_nt_error_from_unix(err));
 		return;
 	}
+	TALLOC_FREE(subreq);
 	tevent_req_done(req);
 }