From: Jeremy Allison Date: Wed, 29 Nov 2017 17:21:30 +0000 (-0800) Subject: s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(). X-Git-Tag: samba-4.6.12~17 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9cc7d3df94cda7c738ed4d9f60ef5f42cc68c2fa;p=thirdparty%2Fsamba.git s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(). cli_smb2_close_fnum_recv() uses tevent_req_simple_recv_ntstatus(req), which frees req, then uses the state pointer which was owned by req. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13171 Signed-off-by: Jeremy Allison Reviewed-by: Ralph Böhme Autobuild-User(master): Jeremy Allison Autobuild-Date(master): Thu Nov 30 05:47:12 CET 2017 on sn-devel-144 (cherry picked from commit 5c8032b6b8ce4439b3ef8f43a62a419f081eb787) Autobuild-User(v4-6-test): Karolin Seeger Autobuild-Date(v4-6-test): Tue Dec 5 14:29:20 CET 2017 on sn-devel-144 --- diff --git a/source3/libsmb/cli_smb2_fnum.c b/source3/libsmb/cli_smb2_fnum.c index 247f4431e57..bf80cd2a193 100644 --- a/source3/libsmb/cli_smb2_fnum.c +++ b/source3/libsmb/cli_smb2_fnum.c @@ -449,8 +449,12 @@ NTSTATUS cli_smb2_close_fnum_recv(struct tevent_req *req) { struct cli_smb2_close_fnum_state *state = tevent_req_data( req, struct cli_smb2_close_fnum_state); - NTSTATUS status = tevent_req_simple_recv_ntstatus(req); - state->cli->raw_status = status; + NTSTATUS status = NT_STATUS_OK; + + if (tevent_req_is_nterror(req, &status)) { + state->cli->raw_status = status; + } + tevent_req_received(req); return status; }