From: Volker Lendecke <vl@samba.org>
Date: Tue, 11 Aug 2020 14:16:12 +0000 (+0200)
Subject: tldap: Only free() ld->pending if "req" is part of it
X-Git-Tag: samba-4.11.14~16
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=90e0feb0a35ddcb0b92a0055d7d5815e66b17505;p=thirdparty%2Fsamba.git

tldap: Only free() ld->pending if "req" is part of it

Best reviewed with "git show -U10". We need to check that "req" is
actually the last request that is being freed before freeing the whole
array.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit b85dbc9ccf80d8c19aff33c1da83954e5d6a37ef)
---

diff --git a/source3/lib/tldap.c b/source3/lib/tldap.c
index bf5fc05d785..9da0e0c086e 100644
--- a/source3/lib/tldap.c
+++ b/source3/lib/tldap.c
@@ -492,11 +492,6 @@ static void tldap_msg_unset_pending(struct tevent_req *req)
 
 	tevent_req_set_cleanup_fn(req, NULL);
 
-	if (num_pending == 1) {
-		TALLOC_FREE(ld->pending);
-		return;
-	}
-
 	for (i=0; i<num_pending; i++) {
 		if (req == ld->pending[i]) {
 			break;
@@ -511,6 +506,11 @@ static void tldap_msg_unset_pending(struct tevent_req *req)
 		return;
 	}
 
+	if (num_pending == 1) {
+		TALLOC_FREE(ld->pending);
+		return;
+	}
+
 	/*
 	 * Remove ourselves from the cli->pending array
 	 */