From: Ralph Boehme <slow@samba.org>
Date: Tue, 27 Mar 2018 14:05:30 +0000 (+0200)
Subject: s3:messages: check reg->refcount == 0 before accessing other elements
X-Git-Tag: ldb-1.4.0~545
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fdcc1622082eaea3fc03c0346a56afbbff88e6d1;p=thirdparty%2Fsamba.git

s3:messages: check reg->refcount == 0 before accessing other elements

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
---

diff --git a/source3/lib/messages.c b/source3/lib/messages.c
index 5a31f3414d7..45e210ff75e 100644
--- a/source3/lib/messages.c
+++ b/source3/lib/messages.c
@@ -192,15 +192,23 @@ static bool messaging_register_event_context(struct messaging_context *ctx,
 	for (i=0; i<num_event_contexts; i++) {
 		struct messaging_registered_ev *reg = &ctx->event_contexts[i];
 
-		if (reg->ev == ev) {
-			reg->refcount += 1;
-			return true;
-		}
 		if (reg->refcount == 0) {
 			if (reg->ev != NULL) {
 				abort();
 			}
 			free_reg = reg;
+			/*
+			 * We continue here and may find another
+			 * free_req, but the important thing is
+			 * that we continue to search for an
+			 * existing registration in the loop.
+			 */
+			continue;
+		}
+
+		if (reg->ev == ev) {
+			reg->refcount += 1;
+			return true;
 		}
 	}
 
@@ -231,10 +239,11 @@ static bool messaging_deregister_event_context(struct messaging_context *ctx,
 	for (i=0; i<num_event_contexts; i++) {
 		struct messaging_registered_ev *reg = &ctx->event_contexts[i];
 
+		if (reg->refcount == 0) {
+			continue;
+		}
+
 		if (reg->ev == ev) {
-			if (reg->refcount == 0) {
-				return false;
-			}
 			reg->refcount -= 1;
 
 			if (reg->refcount == 0) {