From: Volker Lendecke <vl@samba.org>
Date: Sat, 28 Mar 2009 18:58:45 +0000 (+0100)
Subject: Fix smbd crash for close_on_completion
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=51ecc77eeabe5fc89e4d1b1fb8a15c71614d4049;p=thirdparty%2Fsamba.git

Fix smbd crash for close_on_completion

handle_trans() can talloc_free "conn" if the client requests
close_on_completion. "state" is a talloc_child of conn, so it will be gone when
we later free state->data et al.
---

diff --git a/source/smbd/ipc.c b/source/smbd/ipc.c
index a53bc5bea2a..8e40c30210e 100644
--- a/source/smbd/ipc.c
+++ b/source/smbd/ipc.c
@@ -658,6 +658,8 @@ void reply_trans(struct smb_request *req)
 		return;
 	}
 
+	talloc_steal(talloc_tos(), state);
+
 	handle_trans(conn, req, state);
 
 	SAFE_FREE(state->data);
@@ -787,6 +789,8 @@ void reply_transs(struct smb_request *req)
          */
         SCVAL(req->inbuf,smb_com,SMBtrans);
 
+	talloc_steal(talloc_tos(), state);
+
 	handle_trans(conn, req, state);
 
 	DLIST_REMOVE(conn->pending_trans, state);