summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
authorVolker Lendecke <vl@samba.org>2009-07-27 14:47:41 +0200
committerVolker Lendecke <vl@samba.org>2009-07-27 16:15:54 +0200
commit5135ebd6f099518f0a0b5796e8057210be824740 (patch)
tree05e71b54969632ce6d99bf38a70abe2d5c9a7b66 /source3
parentd3132e21f3c93043e3d29584f4094b6edfc02c5a (diff)
downloadsamba-5135ebd6f099518f0a0b5796e8057210be824740.tar.gz
samba-5135ebd6f099518f0a0b5796e8057210be824740.tar.bz2
samba-5135ebd6f099518f0a0b5796e8057210be824740.zip
Fix a valgrind error in chain_reply
construct_reply() references the request after chain_reply has freed it.
Diffstat (limited to 'source3')
-rw-r--r--source3/include/smb.h2
-rw-r--r--source3/smbd/process.c13
2 files changed, 12 insertions, 3 deletions
diff --git a/source3/include/smb.h b/source3/include/smb.h
index 6ccdd968a3..11927443bd 100644
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -655,6 +655,8 @@ struct smb_request {
* state information for async smb handling
*/
void *async_priv;
+
+ bool done;
};
/* Defines for the sent_oplock_break field above. */
diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index 8a4ff42e7f..99c862300d 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -381,6 +381,7 @@ void init_smb_request(struct smb_request *req,
req->conn = conn_find(sconn,req->tid);
req->chain_fsp = NULL;
req->chain_outbuf = NULL;
+ req->done = false;
smb_init_perfcount_data(&req->pcd);
/* Ensure we have at least wct words and 2 bytes of bcc. */
@@ -1403,6 +1404,11 @@ static void construct_reply(char *inbuf, int size, size_t unread_bytes,
req->unread_bytes = 0;
}
+ if (req->done) {
+ TALLOC_FREE(req);
+ return;
+ }
+
if (req->outbuf == NULL) {
return;
}
@@ -1669,8 +1675,8 @@ void chain_reply(struct smb_request *req)
exit_server_cleanly("chain_reply: srv_send_smb "
"failed.");
}
- TALLOC_FREE(req);
-
+ TALLOC_FREE(req->chain_outbuf);
+ req->done = true;
return;
}
@@ -1807,7 +1813,8 @@ void chain_reply(struct smb_request *req)
&req->pcd)) {
exit_server_cleanly("construct_reply: srv_send_smb failed.");
}
- TALLOC_FREE(req);
+ TALLOC_FREE(req->chain_outbuf);
+ req->done = true;
}
/****************************************************************************