Fix smbd crash for close_on_completion

handle_trans() can talloc_free "conn" if the client requests
close_on_completion. "state" is a talloc_child of conn, so it will be gone when
we later free state->data et al.

diff --git a/source/smbd/ipc.c b/source/smbd/ipc.c
index ac5950ec09a3daa7cdc3c126be9f2b09888e9492..5c9f9f63d9006c306c62868172d76dd6eecdada3 100644 (file)
--- a/source/smbd/ipc.c
+++ b/source/smbd/ipc.c
@@ -661,6 +661,8 @@ void reply_trans(struct smb_request *req)
                return;
        }
 
+       talloc_steal(talloc_tos(), state);
+
        handle_trans(conn, req, state);
 
        SAFE_FREE(state->data);
@@ -790,6 +792,8 @@ void reply_transs(struct smb_request *req)
          */
         SCVAL(req->inbuf,smb_com,SMBtrans);
 
+       talloc_steal(talloc_tos(), state);
+
        handle_trans(conn, req, state);
 
        DLIST_REMOVE(conn->pending_trans, state);