From: Stefan Metzmacher <metze@samba.org>
Date: Tue, 9 Jun 2026 10:24:34 +0000 (+0200)
Subject: s3:rpc_server: fix use after free in rpc_worker_new_client() error path
X-Git-Tag: talloc-2.5.0~72
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=177ae16f011e7850abc02bf9163876e6de2fa7a6;p=thirdparty%2Fsamba.git

s3:rpc_server: fix use after free in rpc_worker_new_client() error path

dcesrv_conn is a client of ncacn_conn, so we can't call
TALLOC_FREE(dcesrv_conn); after TALLOC_FREE(ncacn_conn);

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
---

diff --git a/source3/rpc_server/rpc_worker.c b/source3/rpc_server/rpc_worker.c
index b6d3420f61d..635dae10ca5 100644
--- a/source3/rpc_server/rpc_worker.c
+++ b/source3/rpc_server/rpc_worker.c
@@ -504,7 +504,6 @@ static void rpc_worker_new_client(
 	return;
 fail:
 	TALLOC_FREE(ncacn_conn);
-	TALLOC_FREE(dcesrv_conn);
 	TALLOC_FREE(client);
 	if (sock != -1) {
 		close(sock);