r2618: before we had refererence counts in talloc I added a hack in the

server side request structure to prevent a structing being freed in
some circumstances. This change replaces this with the much more
robust mechanism of talloc_increase_ref_count().
(This used to be commit 3f7741f178b359f81cc98ef18cd69bf976123e9f)

1 files changed, 3 insertions, 5 deletions

diff --git a/source4/smb_server/trans2.c b/source4/smb_server/trans2.c
index a5033f9b56..e681c9fe29 100644
--- a/source4/smb_server/trans2.c
+++ b/source4/smb_server/trans2.c
@@ -1323,8 +1323,6 @@ void reply_trans_generic(struct smbsrv_request *req, uint8_t command)
 	params      = trans.out.params.data;
 	data        = trans.out.data.data;
 
-	req->control_flags |= REQ_CONTROL_PROTECTED;
-
 	/* we need to divide up the reply into chunks that fit into
 	   the negotiated buffer size */
 	do {
@@ -1384,9 +1382,9 @@ void reply_trans_generic(struct smbsrv_request *req, uint8_t command)
 		params += this_param;
 		data += this_data;
 
-		/* if this is the last chunk then the request can be destroyed */
-		if (params_left == 0 && data_left == 0) {
-			req->control_flags &= ~REQ_CONTROL_PROTECTED;
+		/* don't destroy unless this is the last chunk */
+		if (params_left != 0 || data_left != 0) {
+			talloc_increase_ref_count(req);
 		}
 
 		req_send_reply(req);