Fix use of DLIST_REMOVE as spotted by Constantine Vetoshev <gepardcv@gmail.com>.

This API is unusual in that if used to remove a non-list head it nulls out
the next and prev pointers. This is what you want for debugging (don't want
an entry removed from the list to be still virtually linked into it) but
means there is no consistent idiom for use as the next and prev pointers
get trashed on removal from the list, meaning you must save them yourself.
You can use it one way when deleting everything via the head pointer, as
this preserves the next pointer, but you *must* use it another way when not
deleting everything via the head pointer. Fix all known uses of this (the main
one is in conn_free_internal() and would not free all the private data entries
for vfs modules. The other changes in web/statuspage.c and winbindd_util.c
are not strictly neccessary, as the head pointer is being used, but I've done
them for consistency. Long term we must revisit this as this API is too hard
to use correctly.
Jeremy.

diff --git a/source/smbd/conn.c b/source/smbd/conn.c
index c5a2df47739e15a4fa0a880f09b55615e36fbd43..cfcec5128f0475910d4416893de456fd0aa6f5b0 100644 (file)
--- a/source/smbd/conn.c
+++ b/source/smbd/conn.c
@@ -267,8 +267,8 @@ void conn_free_internal(connection_struct *conn)
        /* Free vfs_connection_struct */
        handle = conn->vfs_handles;
        while(handle) {
-               DLIST_REMOVE(conn->vfs_handles, handle);
                thandle = handle->next;
+               DLIST_REMOVE(conn->vfs_handles, handle);
                if (handle->free_data)
                        handle->free_data(&handle->data);
                handle = thandle;

diff --git a/source/web/statuspage.c b/source/web/statuspage.c
index eda53b66ab307a4188b07290a707128b07a6c582..5d9a23922fd6ade350431f4400b754fb02b4d4a8 100644 (file)
--- a/source/web/statuspage.c
+++ b/source/web/statuspage.c
@@ -43,9 +43,10 @@ static void initPid2Machine (void)
 {
        /* show machine name rather PID on table "Open Files"? */
        if (PID_or_Machine) {
-               PIDMAP *p;
+               PIDMAP *p, *next;
 
-               for (p = pidmap; p != NULL; ) {
+               for (p = pidmap; p != NULL; p = next) {
+                       next = p->next;
                        DLIST_REMOVE(pidmap, p);
                        SAFE_FREE(p->machine);
                        SAFE_FREE(p);

diff --git a/source/winbindd/winbindd_util.c b/source/winbindd/winbindd_util.c
index 3425b4cc9ca679478dcf0b2818687955db9d4dc0..cf7663d26082dba52165cf88d53566c478b73f69 100644 (file)
--- a/source/winbindd/winbindd_util.c
+++ b/source/winbindd/winbindd_util.c
@@ -1042,13 +1042,12 @@ void free_getent_state(struct getent_state *state)
        temp = state;
 
        while(temp != NULL) {
-               struct getent_state *next;
+               struct getent_state *next = temp->next;
 
                /* Free sam entries then list entry */
 
                SAFE_FREE(state->sam_entries);
                DLIST_REMOVE(state, state);
-               next = temp->next;
 
                SAFE_FREE(temp);
                temp = next;