From: Shachar Sharon <ssharon@redhat.com>
Date: Thu, 30 Apr 2026 11:11:49 +0000 (+0300)
Subject: libcli/dns: fix use-after-free oom case
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1b762a4ea48635c534fe937d60b5e358ff6cab6c;p=thirdparty%2Fsamba.git

libcli/dns: fix use-after-free oom case

A failure to tevent_wakeup_recv(subreq) should trigger oom call on 'req'
(instead on 'subreq', which has already been free).

Signed-off-by: Shachar Sharon <ssharon@redhat.com>
Reviewed-by: Noel Power <npower@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>

Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Sat May  2 14:51:58 UTC 2026 on atb-devel-224
---

diff --git a/libcli/dns/dns.c b/libcli/dns/dns.c
index 2482e1353e7..782fdd0d730 100644
--- a/libcli/dns/dns.c
+++ b/libcli/dns/dns.c
@@ -574,7 +574,7 @@ static void dns_cli_request_trigger_tcp(struct tevent_req *subreq)
 	ok = tevent_wakeup_recv(subreq);
 	TALLOC_FREE(subreq);
 	if (!ok) {
-		tevent_req_oom(subreq);
+		tevent_req_oom(req);
 		return;
 	}