pytalloc: ensure talloc_ctx is directly after PyObject_HEAD

the talloc python interface for tp_alloc and tp_dealloc relies on a
cast to a py_talloc_Object to find the talloc_ctx (see
py_talloc_dealloc). This means we rely on the talloc_ctx for the
object being directly after the PyObject_HEAD

This fixes the talloc free with references bug in samba_dnsupdate

The actual problem was the tp_alloc() call in
PyCredentialCacheContainer_from_ccache_container() which used a cast
from a py_talloc_Object to a PyCredentialCacheContainerObject. That
case effectively changed the parent/child relationship between the
talloc_ctx and the ccc ptr.

This patch changes all the structures that follow this pattern to put
the TALLOC_CTX directly after the PyObject_HEAD, to ensure that if
anyone else decides to do a dangerous cast like this that it won't
cause the same sort of subtle breakage.

Pair-Programmed-With: Rusty Russell <rusty@samba.org>

1 files changed, 2 insertions, 2 deletions

diff --git a/source4/lib/messaging/pymessaging.c b/source4/lib/messaging/pymessaging.c
index 35e009385f..cea3accce0 100644
--- a/source4/lib/messaging/pymessaging.c
+++ b/source4/lib/messaging/pymessaging.c
@@ -303,10 +303,10 @@ PyTypeObject messaging_Type = {
 */
 typedef struct {
 	PyObject_HEAD
+	TALLOC_CTX *mem_ctx;
 	const char *server_name;
 	struct server_id *dest_ids;
 	struct messaging_context *msg_ctx;
-	TALLOC_CTX *mem_ctx;
 } irpc_ClientConnectionObject;
 
 /*
@@ -382,10 +382,10 @@ PyObject *py_irpc_connect(PyTypeObject *self, PyObject *args, PyObject *kwargs)
 
 typedef struct {
 	PyObject_HEAD
+	TALLOC_CTX *mem_ctx;
 	struct irpc_request **reqs;
 	int count;
 	int current;
-	TALLOC_CTX *mem_ctx;
 	py_data_unpack_fn unpack_fn;
 } irpc_ResultObject;