diff options
| author | Volker Lendecke <vl@samba.org> | 2009-07-27 14:47:41 +0200 |
|---|---|---|
| committer | Volker Lendecke <vl@samba.org> | 2009-07-27 16:15:54 +0200 |
| commit | 5135ebd6f099518f0a0b5796e8057210be824740 (patch) | |
| tree | 05e71b54969632ce6d99bf38a70abe2d5c9a7b66 /source3 | |
| parent | d3132e21f3c93043e3d29584f4094b6edfc02c5a (diff) | |
| download | samba-5135ebd6f099518f0a0b5796e8057210be824740.tar.gz samba-5135ebd6f099518f0a0b5796e8057210be824740.tar.bz2 samba-5135ebd6f099518f0a0b5796e8057210be824740.zip | |
Fix a valgrind error in chain_reply
construct_reply() references the request after chain_reply has freed it.
Diffstat (limited to 'source3')
| -rw-r--r-- | source3/include/smb.h | 2 | ||||
| -rw-r--r-- | source3/smbd/process.c | 13 |
2 files changed, 12 insertions, 3 deletions
diff --git a/source3/include/smb.h b/source3/include/smb.h index 6ccdd968a3..11927443bd 100644 --- a/source3/include/smb.h +++ b/source3/include/smb.h @@ -655,6 +655,8 @@ struct smb_request { * state information for async smb handling */ void *async_priv; + + bool done; }; /* Defines for the sent_oplock_break field above. */ diff --git a/source3/smbd/process.c b/source3/smbd/process.c index 8a4ff42e7f..99c862300d 100644 --- a/source3/smbd/process.c +++ b/source3/smbd/process.c @@ -381,6 +381,7 @@ void init_smb_request(struct smb_request *req, req->conn = conn_find(sconn,req->tid); req->chain_fsp = NULL; req->chain_outbuf = NULL; + req->done = false; smb_init_perfcount_data(&req->pcd); /* Ensure we have at least wct words and 2 bytes of bcc. */ @@ -1403,6 +1404,11 @@ static void construct_reply(char *inbuf, int size, size_t unread_bytes, req->unread_bytes = 0; } + if (req->done) { + TALLOC_FREE(req); + return; + } + if (req->outbuf == NULL) { return; } @@ -1669,8 +1675,8 @@ void chain_reply(struct smb_request *req) exit_server_cleanly("chain_reply: srv_send_smb " "failed."); } - TALLOC_FREE(req); - + TALLOC_FREE(req->chain_outbuf); + req->done = true; return; } @@ -1807,7 +1813,8 @@ void chain_reply(struct smb_request *req) &req->pcd)) { exit_server_cleanly("construct_reply: srv_send_smb failed."); } - TALLOC_FREE(req); + TALLOC_FREE(req->chain_outbuf); + req->done = true; } /**************************************************************************** |