From: Volker Lendecke Date: Tue, 11 Aug 2020 14:54:34 +0000 (+0200) Subject: tldap: Fix tldap_msg_received() X-Git-Tag: samba-4.11.14~15 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=31a8c24a5d197a5e19788ea4a089c9016bcbc1cc;p=thirdparty%2Fsamba.git tldap: Fix tldap_msg_received() The callback of "req" might have destroyed "ld", we can't reference this anymore after calling tevent_req_done(req). Defer calling the callbacks, which also means that the callbacks can't have added anything to ld->pending. Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465 Signed-off-by: Volker Lendecke Reviewed-by: Stefan Metzmacher (cherry picked from commit f816ccb8f4d212fe7f6bf36f90cbb9297c899786) --- diff --git a/source3/lib/tldap.c b/source3/lib/tldap.c index 9da0e0c086e..9274db126c4 100644 --- a/source3/lib/tldap.c +++ b/source3/lib/tldap.c @@ -677,21 +677,13 @@ static void tldap_msg_received(struct tevent_req *subreq) tldap_msg_unset_pending(req); num_pending = talloc_array_length(ld->pending); + tevent_req_defer_callback(req, state->ev); tevent_req_done(req); done: if (num_pending == 0) { return; } - if (talloc_array_length(ld->pending) > num_pending) { - /* - * The callback functions called from tevent_req_done() above - * have put something on the pending queue. We don't have to - * trigger the read_ldap_send(), tldap_msg_set_pending() has - * done it for us already. - */ - return; - } state = tevent_req_data(ld->pending[0], struct tldap_msg_state); subreq = read_ldap_send(ld->pending, state->ev, ld->conn);