From: Volker Lendecke <vl@samba.org>
Date: Thu, 20 Mar 2025 16:57:11 +0000 (+0100)
Subject: net: Fix a panic in "net vfs getntacl"
X-Git-Tag: tevent-0.17.0~22
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3c76c3989c9628a5e4c4e704185f4257620deccd;p=thirdparty%2Fsamba.git

net: Fix a panic in "net vfs getntacl"

We have to explicitly free smb_fname, because after openat_pathref_fsp
we have a file descriptor around. If we then later talloc_free() the
connection_struct, fd_handle_destructor() panics because talloc_free()
does not free smb_fname before the connection_struct.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>
---

diff --git a/source3/utils/net_vfs.c b/source3/utils/net_vfs.c
index 1cc775f3c4d..8120811676e 100644
--- a/source3/utils/net_vfs.c
+++ b/source3/utils/net_vfs.c
@@ -278,6 +278,7 @@ static int net_vfs_get_ntacl(struct net_context *net,
 	if (!NT_STATUS_IS_OK(status)) {
 		DBG_ERR("SMB_VFS_CREATE_FILE [%s] failed: %s\n",
 			smb_fname_str_dbg(smb_fname), nt_errstr(status));
+		TALLOC_FREE(smb_fname);
 		goto done;
 	}