s4-drepl: Ensure that the op->source does not get deallocated too early

We need to have the struct dreplsrv_partition_source_dsa around until the end of the
async op, so we use talloc_reference after carefully checking the callers and
making the modifications required.

This prevents a crash when replicating partitions in the vampire_dc test after
adding DNS replication at join time.

Andrew Bartlett

1 files changed, 19 insertions, 1 deletions

diff --git a/source4/dsdb/repl/drepl_out_pull.c b/source4/dsdb/repl/drepl_out_pull.c
index 86b513d21d..58d877870e 100644
--- a/source4/dsdb/repl/drepl_out_pull.c
+++ b/source4/dsdb/repl/drepl_out_pull.c
@@ -101,7 +101,25 @@ WERROR dreplsrv_schedule_partition_pull_source(struct dreplsrv_service *s,
 	W_ERROR_HAVE_NO_MEMORY(op);
 
 	op->service	= s;
-	op->source_dsa	= source;
+	/*
+	 * source may either be the long-term list of partners, or
+	 * from dreplsrv_partition_source_dsa_temporary().  Because it
+	 * can be either, we can't talloc_steal() it here, so we
+	 * instead we reference it.
+	 *
+	 * We never talloc_free() the p->sources pointers - indeed we
+	 * never remove them - and the temp source will otherwise go
+	 * away with the msg it is allocated on.
+	 *
+	 * Finally the pointer created in drepl_request_extended_op()
+	 * is removed with talloc_unlink().
+	 *
+	 */
+	op->source_dsa	= talloc_reference(op, source);
+	if (!op->source_dsa) {
+		return WERR_NOMEM;
+	}
+
 	op->options	= options;
 	op->extended_op = extended_op;
 	op->fsmo_info   = fsmo_info;