pytalloc: ensure talloc_ctx is directly after PyObject_HEAD

the talloc python interface for tp_alloc and tp_dealloc relies on a
cast to a py_talloc_Object to find the talloc_ctx (see
py_talloc_dealloc). This means we rely on the talloc_ctx for the
object being directly after the PyObject_HEAD

This fixes the talloc free with references bug in samba_dnsupdate

The actual problem was the tp_alloc() call in
PyCredentialCacheContainer_from_ccache_container() which used a cast
from a py_talloc_Object to a PyCredentialCacheContainerObject. That
case effectively changed the parent/child relationship between the
talloc_ctx and the ccc ptr.

This patch changes all the structures that follow this pattern to put
the TALLOC_CTX directly after the PyObject_HEAD, to ensure that if
anyone else decides to do a dangerous cast like this that it won't
cause the same sort of subtle breakage.

Pair-Programmed-With: Rusty Russell <rusty@samba.org>

2 files changed, 8 insertions, 8 deletions

diff --git a/source4/lib/ldb/pyldb.h b/source4/lib/ldb/pyldb.h
index 289159c5b3..545011e4c9 100644
--- a/source4/lib/ldb/pyldb.h
+++ b/source4/lib/ldb/pyldb.h
@@ -31,8 +31,8 @@
 
 typedef struct {
 	PyObject_HEAD
-	struct ldb_context *ldb_ctx;
 	TALLOC_CTX *mem_ctx;
+	struct ldb_context *ldb_ctx;
 } PyLdbObject;
 
 #define PyLdb_AsLdbContext(pyobj) ((PyLdbObject *)pyobj)->ldb_ctx
@@ -40,8 +40,8 @@ typedef struct {
 
 typedef struct {
 	PyObject_HEAD
-	struct ldb_dn *dn;
 	TALLOC_CTX *mem_ctx;
+	struct ldb_dn *dn;
 } PyLdbDnObject;
 
 PyObject *PyLdbDn_FromDn(struct ldb_dn *);
@@ -51,16 +51,16 @@ bool PyObject_AsDn(TALLOC_CTX *mem_ctx, PyObject *object, struct ldb_context *ld
 
 typedef struct {
 	PyObject_HEAD
-	struct ldb_message *msg;
 	TALLOC_CTX *mem_ctx;
+	struct ldb_message *msg;
 } PyLdbMessageObject;
 #define PyLdbMessage_Check(ob) PyObject_TypeCheck(ob, &PyLdbMessage)
 #define PyLdbMessage_AsMessage(pyobj) ((PyLdbMessageObject *)pyobj)->msg
 
 typedef struct {
 	PyObject_HEAD
-	struct ldb_module *mod;
 	TALLOC_CTX *mem_ctx;
+	struct ldb_module *mod;
 } PyLdbModuleObject;
 PyObject *PyLdbMessage_FromMessage(struct ldb_message *message);
 PyObject *PyLdbModule_FromModule(struct ldb_module *mod);
@@ -68,8 +68,8 @@ PyObject *PyLdbModule_FromModule(struct ldb_module *mod);
 
 typedef struct {
 	PyObject_HEAD	
-	struct ldb_message_element *el;
 	TALLOC_CTX *mem_ctx;
+	struct ldb_message_element *el;
 } PyLdbMessageElementObject;
 struct ldb_message_element *PyObject_AsMessageElement(TALLOC_CTX *mem_ctx, PyObject *obj, int flags, const char *name);
 PyObject *PyLdbMessageElement_FromMessageElement(struct ldb_message_element *, TALLOC_CTX *mem_ctx);
@@ -78,8 +78,8 @@ PyObject *PyLdbMessageElement_FromMessageElement(struct ldb_message_element *, T
 
 typedef struct {
 	PyObject_HEAD
-	struct ldb_parse_tree *tree;
 	TALLOC_CTX *mem_ctx;
+	struct ldb_parse_tree *tree;
 } PyLdbTreeObject;
 PyObject *PyLdbTree_FromTree(struct ldb_parse_tree *);
 #define PyLdbTree_AsTree(pyobj) ((PyLdbTreeObject *)pyobj)->tree
diff --git a/source4/lib/messaging/pymessaging.c b/source4/lib/messaging/pymessaging.c
index 35e009385f..cea3accce0 100644
--- a/source4/lib/messaging/pymessaging.c
+++ b/source4/lib/messaging/pymessaging.c
@@ -303,10 +303,10 @@ PyTypeObject messaging_Type = {
 */
 typedef struct {
 	PyObject_HEAD
+	TALLOC_CTX *mem_ctx;
 	const char *server_name;
 	struct server_id *dest_ids;
 	struct messaging_context *msg_ctx;
-	TALLOC_CTX *mem_ctx;
 } irpc_ClientConnectionObject;
 
 /*
@@ -382,10 +382,10 @@ PyObject *py_irpc_connect(PyTypeObject *self, PyObject *args, PyObject *kwargs)
 
 typedef struct {
 	PyObject_HEAD
+	TALLOC_CTX *mem_ctx;
 	struct irpc_request **reqs;
 	int count;
 	int current;
-	TALLOC_CTX *mem_ctx;
 	py_data_unpack_fn unpack_fn;
 } irpc_ResultObject;