From: Pavel Filipenský <pfilipensky@samba.org>
Date: Thu, 22 Jan 2026 13:27:09 +0000 (+0100)
Subject: s3:libads: Allocate cli_credentials on a stackframe
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4c657abaa0a65cb1922b966a419b1dbb2be274b2;p=thirdparty%2Fsamba.git

s3:libads: Allocate cli_credentials on a stackframe

This fixes:
ERROR: talloc_free with references at ../../source3/libads/ldap_utils.c:158

What happens:

* `struct cli_credentials *creds` is allocated on `ads` talloc context
* gensec_set_credentials() creates a talloc_reference to `creds`
* TALLOC_FREE(creds) sees two parents and complains

All other code is using temporary talloc_stackframe() for `creds`.
Do it here as well.

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Jan 23 11:20:28 UTC 2026 on atb-devel-224
---

diff --git a/source3/libads/ldap_utils.c b/source3/libads/ldap_utils.c
index fd154c6b6e5..26d0063bc13 100644
--- a/source3/libads/ldap_utils.c
+++ b/source3/libads/ldap_utils.c
@@ -123,6 +123,7 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind
 		struct cli_credentials *creds = NULL;
 		char *cred_name = NULL;
 		NTSTATUS ntstatus;
+		TALLOC_CTX *frame = talloc_stackframe();
 
 		search_end = time(NULL);
 		if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT))
@@ -140,18 +141,20 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind
 			DBG_NOTICE("Search for %s in <%s> failed: %s\n",
 				   expr, bp, ads_errstr(status));
 			SAFE_FREE(bp);
+			TALLOC_FREE(frame);
 			return status;
 		}
 
 		ntstatus = ads->auth.reconnect_state->fn(ads,
 				ads->auth.reconnect_state->private_data,
-				ads, &creds);
+				frame, &creds);
 		if (!NT_STATUS_IS_OK(ntstatus)) {
 			DBG_WARNING("Failed to get creds for realm(%s): %s\n",
 				    ads->server.realm, nt_errstr(ntstatus));
 			DBG_WARNING("Search for %s in <%s> failed: %s\n",
 				   expr, bp, ads_errstr(status));
 			SAFE_FREE(bp);
+			TALLOC_FREE(frame);
 			return status;
 		}
 
@@ -172,11 +175,11 @@ static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind
 			 * callers depend on it being around.
 			 */
 			ads_disconnect(ads);
-			TALLOC_FREE(creds);
+			TALLOC_FREE(frame);
 			SAFE_FREE(bp);
 			return status;
 		}
-		TALLOC_FREE(creds);
+		TALLOC_FREE(frame);
 
 		*res = NULL;