r12247: - reject freeing the wrepl_socket inside of wrepl_socket_dead()

- free it at the end of wrepl_socket_dead() if needed

metze
(This used to be commit 58285115c83a3b7bbc9bf52a105cebd11831e9d8)

2 files changed, 12 insertions, 1 deletions

diff --git a/source4/libcli/wrepl/winsrepl.c b/source4/libcli/wrepl/winsrepl.c
index adb2f09469..ead8376834 100644
--- a/source4/libcli/wrepl/winsrepl.c
+++ b/source4/libcli/wrepl/winsrepl.c
@@ -35,7 +35,6 @@ static struct wrepl_request *wrepl_request_finished(struct wrepl_request *req, N
 */
 static void wrepl_socket_dead(struct wrepl_socket *wrepl_socket, NTSTATUS status)
 {
-	talloc_set_destructor(wrepl_socket, NULL);
 	wrepl_socket->dead = True;
 
 	if (wrepl_socket->packet) {
@@ -62,6 +61,11 @@ static void wrepl_socket_dead(struct wrepl_socket *wrepl_socket, NTSTATUS status
 		DLIST_REMOVE(wrepl_socket->recv_queue, req);
 		wrepl_request_finished(req, status);
 	}
+
+	talloc_set_destructor(wrepl_socket, NULL);
+	if (wrepl_socket->free_skipped) {
+		talloc_free(wrepl_socket);
+	}
 }
 
 static void wrepl_request_timeout_handler(struct event_context *ev, struct timed_event *te,
@@ -135,6 +139,10 @@ static void wrepl_error(void *private, NTSTATUS status)
 static int wrepl_socket_destructor(void *ptr)
 {
 	struct wrepl_socket *sock = talloc_get_type(ptr, struct wrepl_socket);
+	if (sock->dead) {
+		sock->free_skipped = True;
+		return -1;
+	}
 	wrepl_socket_dead(sock, NT_STATUS_LOCAL_DISCONNECT);
 	return 0;
 }
diff --git a/source4/libcli/wrepl/winsrepl.h b/source4/libcli/wrepl/winsrepl.h
index 9bedfe7548..e679bef6e6 100644
--- a/source4/libcli/wrepl/winsrepl.h
+++ b/source4/libcli/wrepl/winsrepl.h
@@ -47,6 +47,9 @@ struct wrepl_socket {
 
 	/* remember is the socket is dead */
 	BOOL dead;
+
+	/* remember if we need to free the wrepl_socket at the end of wrepl_socket_dead() */
+	BOOL free_skipped;
 };
 
 struct wrepl_send_ctrl {