summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2006-12-13 22:19:10 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 12:16:28 -0500
commit25f897053946eb9eeb56acb090ef691bf0e7edd4 (patch)
tree21f04b27ee159013125a086b47d43d6632f55129 /source3
parent1da72a1c3f1eddb2c5d7d8c25439254fc6df04e4 (diff)
downloadsamba-25f897053946eb9eeb56acb090ef691bf0e7edd4.tar.gz
samba-25f897053946eb9eeb56acb090ef691bf0e7edd4.tar.bz2
samba-25f897053946eb9eeb56acb090ef691bf0e7edd4.zip
r20160: Fix long-standing (ie. from initial code I think) bug
in tdb message processing. If we're inside a dispatch function and we delete our own handler we'd walk onto the next pointer from a deleted memory block. Fixes crash bug in winbindd (and goodness knows where else). Jeremy. (This used to be commit 27a4c1121404e346432d90b97b518861e038e9f2)
Diffstat (limited to 'source3')
-rw-r--r--source3/lib/messages.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/source3/lib/messages.c b/source3/lib/messages.c
index 93e12ebe35..10fc5af24d 100644
--- a/source3/lib/messages.c
+++ b/source3/lib/messages.c
@@ -471,7 +471,6 @@ void message_dispatch(void)
char *buf;
char *msgs_buf;
size_t len, total_len;
- struct dispatch_fns *dfn;
int n_handled;
if (!received_signal)
@@ -485,11 +484,15 @@ void message_dispatch(void)
return;
for (buf = msgs_buf; message_recv(msgs_buf, total_len, &msg_type, &src, &buf, &len); buf += len) {
+ struct dispatch_fns *dfn, *next;
+
DEBUG(10,("message_dispatch: received msg_type=%d "
"src_pid=%u\n", msg_type,
(unsigned int) procid_to_pid(&src)));
+
n_handled = 0;
- for (dfn = dispatch_fns; dfn; dfn = dfn->next) {
+ for (dfn = dispatch_fns; dfn; dfn = next) {
+ next = dfn->next;
if (dfn->msg_type == msg_type) {
DEBUG(10,("message_dispatch: processing message of type %d.\n", msg_type));
dfn->fn(msg_type, src, len ? (void *)buf : NULL, len);