summaryrefslogtreecommitdiff
path: root/source3/smbd
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2010-01-05 14:34:00 -0800
committerJeremy Allison <jra@samba.org>2010-01-05 14:34:00 -0800
commitf6bd654a6c878111f0f0f4d07adb644fc3bbf224 (patch)
treede639314746fdfe327fe8272f26572088710e153 /source3/smbd
parenta08a0ffd37cbf0c87c054a499f549d74598e2db4 (diff)
downloadsamba-f6bd654a6c878111f0f0f4d07adb644fc3bbf224.tar.gz
samba-f6bd654a6c878111f0f0f4d07adb644fc3bbf224.tar.bz2
samba-f6bd654a6c878111f0f0f4d07adb644fc3bbf224.zip
Fix bug #7020 - smbd using 2G memory.
When deferring an async pipe writeX and readX transfer the outstanding request struct onto the conn struct. This needs freeing after the packet is finally processed. Jeremy.
Diffstat (limited to 'source3/smbd')
-rw-r--r--source3/smbd/pipes.c10
1 files changed, 10 insertions, 0 deletions
diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c
index bf64c59afd..9bc3fdfdf6 100644
--- a/source3/smbd/pipes.c
+++ b/source3/smbd/pipes.c
@@ -353,6 +353,11 @@ static void pipe_write_andx_done(struct tevent_req *subreq)
done:
chain_reply(req);
+ /*
+ * We must free here as the ownership of req was
+ * moved to the connection struct in reply_pipe_write_and_X().
+ */
+ TALLOC_FREE(req);
}
/****************************************************************************
@@ -458,4 +463,9 @@ static void pipe_read_andx_done(struct tevent_req *subreq)
done:
chain_reply(req);
+ /*
+ * We must free here as the ownership of req was
+ * moved to the connection struct in reply_pipe_read_and_X().
+ */
+ TALLOC_FREE(req);
}