2 files changed, 21 insertions, 10 deletions

diff --git a/source4/lib/events/events_liboop.c b/source4/lib/events/events_liboop.c
index ad7c43cd4e..54cb8d5a52 100644
--- a/source4/lib/events/events_liboop.c
+++ b/source4/lib/events/events_liboop.c
@@ -172,12 +172,23 @@ static void oop_event_set_fd_flags(struct fd_event *fde, uint16_t flags)
 	fde->flags = flags;
 }
 
+static int oop_event_timed_destructor(void *ptr);
+static int oop_event_timed_deny_destructor(void *ptr)
+{
+	return -1;
+}
+
 static void *oop_event_timed_handler(oop_source *oop, struct timeval t, void *ptr)
 {
 	struct timed_event *te = ptr;
 
+	/* deny the handler to free the event */
+	talloc_set_destructor(te, oop_event_timed_deny_destructor);
 	te->handler(te->event_ctx, te, t, te->private_data);
 
+	talloc_set_destructor(te, oop_event_timed_destructor);
+	talloc_free(te);
+
 	return OOP_CONTINUE;
 }
 
@@ -218,7 +229,7 @@ static struct timed_event *oop_event_add_timed(struct event_context *ev, TALLOC_
 	te->private_data	= private_data;
 	te->additional_data	= NULL;
 
-	oop->cancel_time(oop, te->next_event, oop_event_timed_handler, te);
+	oop->on_time(oop, te->next_event, oop_event_timed_handler, te);
 
 	talloc_set_destructor(te, oop_event_timed_destructor);
 
diff --git a/source4/lib/events/events_standard.c b/source4/lib/events/events_standard.c
index 810e8bbca3..8fe8d009bf 100644
--- a/source4/lib/events/events_standard.c
+++ b/source4/lib/events/events_standard.c
@@ -284,6 +284,11 @@ static int std_event_timed_destructor(void *ptr)
 	return 0;
 }
 
+static int std_event_timed_deny_destructor(void *ptr)
+{
+	return -1;
+}
+
 /*
   add a timed event
   return NULL on failure (memory allocation error)
@@ -340,17 +345,12 @@ static void std_event_loop_timer(struct event_context *ev)
 		return;
 	}
 
-	te->next_event = timeval_zero();
-
+	/* deny the handler to free the event */
+	talloc_set_destructor(te, std_event_timed_deny_destructor);
 	te->handler(ev, te, t, te->private_data);
 
-	/* note the care taken to prevent referencing a event
-	   that could have been freed by the handler */
-	if (std_ev->timed_events) {
-		if (timeval_is_zero(&std_ev->timed_events->next_event)) {
-			talloc_free(te);
-		}
-	}
+	talloc_set_destructor(te, std_event_timed_destructor);
+	talloc_free(te);
 }
 
 #if WITH_EPOLL