r7653: when a dcerpc request times out, we need to ensure that if the server

does finally answer the request and it is on the smb transport that we
don't die in the callback code as the rpc request state is gone.
(This used to be commit d47477c5c3acbaa7242fa3a06d4095258db86297)

1 files changed, 11 insertions, 1 deletions

diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index 1f4e72639e..bd4756cb21 100644
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -513,6 +513,7 @@ static void init_ncacn_hdr(struct dcerpc_connection *c, struct ncacn_packet *pkt
   hold the state of pending full requests
 */
 struct full_request_state {
+	struct dcerpc_connection *c;
 	DATA_BLOB *reply_blob;
 	NTSTATUS status;
 };
@@ -523,7 +524,12 @@ struct full_request_state {
 static void full_request_recv(struct dcerpc_connection *c, DATA_BLOB *blob, 
 			      NTSTATUS status)
 {
-	struct full_request_state *state = c->full_request_private;
+	struct full_request_state *state = talloc_get_type(c->full_request_private,
+							   struct full_request_state);
+	if (state == NULL) {
+		/* it timed out earlier */
+		return;
+	}
 
 	if (!NT_STATUS_IS_OK(status)) {
 		state->status = status;
@@ -542,6 +548,7 @@ static void dcerpc_full_timeout_handler(struct event_context *ev, struct timed_e
 	struct full_request_state *state = talloc_get_type(private, 
 							   struct full_request_state);
 	state->status = NT_STATUS_IO_TIMEOUT;
+	state->c->full_request_private = NULL;
 }
 
 /*
@@ -562,6 +569,7 @@ static NTSTATUS full_request(struct dcerpc_connection *c,
 
 	state->reply_blob = reply_blob;
 	state->status = NT_STATUS_OK;
+	state->c = c;
 
 	c->transport.recv_data = full_request_recv;
 	c->full_request_private = state;
@@ -581,6 +589,8 @@ static NTSTATUS full_request(struct dcerpc_connection *c,
 		}
 	}
 
+	c->full_request_private = NULL;
+
 	return state->status;
 }