From: Jeremy Allison <jra@samba.org>
Date: Thu, 5 Mar 2015 20:48:47 +0000 (-0800)
Subject: lib: talloc: Fix bug when calling a destructor.
X-Git-Tag: samba-4.0.26~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8194d069e55914710656abc8fb9d16a1fb24eb1c;p=thirdparty%2Fsamba.git

lib: talloc: Fix bug when calling a destructor.

If the destructor itself calls talloc_set_destructor()
and returns -1, the new destructor set is overwritten
by talloc.

Dectect that and leave the new destructor in place.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
(cherry picked from commit 3289a5d84f73bf044e5767a6c47a3f7bf8357c08)
---

diff --git a/lib/talloc/talloc.c b/lib/talloc/talloc.c
index fa56ea56780..1ccb039ff74 100644
--- a/lib/talloc/talloc.c
+++ b/lib/talloc/talloc.c
@@ -991,7 +991,13 @@ static inline int _talloc_free_internal(void *ptr, const char *location)
 		}
 		tc->destructor = (talloc_destructor_t)-1;
 		if (d(ptr) == -1) {
-			tc->destructor = d;
+			/*
+			 * Only replace the destructor pointer if
+			 * calling the destructor didn't modify it.
+			 */
+			if (tc->destructor == (talloc_destructor_t)-1) {
+				tc->destructor = d;
+			}
 			return -1;
 		}
 		tc->destructor = NULL;