lib: poll_funcs : poll_funcs_context_slot_find can select the wrong slot to replace.

Look for an exact match first, before a free slot.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12272

Back-port from 085542fc93b3c603e8cda6e481e94d5fe2dfc669

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(v4-3-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-3-test): Tue Sep 20 13:38:44 CEST 2016 on sn-devel-104

diff --git a/source3/lib/poll_funcs/poll_funcs_tevent.c b/source3/lib/poll_funcs/poll_funcs_tevent.c
index aba989d8df53fb0fd4a19f3af8689987d2387e27..a18cb235759eebe30f2df39e0f3fe3cf2fd7943e 100644 (file)
--- a/source3/lib/poll_funcs/poll_funcs_tevent.c
+++ b/source3/lib/poll_funcs/poll_funcs_tevent.c
@@ -318,15 +318,27 @@ static bool poll_funcs_context_slot_find(struct poll_funcs_state *state,
        struct poll_funcs_tevent_context **contexts;
        unsigned i;
 
+       /* Look for an existing match first. */
        for (i=0; i<state->num_contexts; i++) {
                struct poll_funcs_tevent_context *ctx = state->contexts[i];
 
-               if ((ctx == NULL) || (ctx->ev == ev)) {
+               if (ctx != NULL && ctx->ev == ev) {
                        *slot = i;
                        return true;
                }
        }
 
+       /* Now look for a free slot. */
+       for (i=0; i<state->num_contexts; i++) {
+               struct poll_funcs_tevent_context *ctx = state->contexts[i];
+
+               if (ctx == NULL) {
+                       *slot = i;
+                       return true;
+               }
+       }
+
+
        contexts = talloc_realloc(state, state->contexts,
                                  struct poll_funcs_tevent_context *,
                                  state->num_contexts + 1);