sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-11-11 00:23:51 +03:00
Code Activity

r10709: fixed a crash bug rather similar to the one volker found in the dcerpc

Browse Source 
code, where a stream_terminate_connection() while processing a request
can cause a later defererence of the connection structure to die.
This commit is contained in:
Andrew Tridgell
2005-10-04 10:18:07 +00:00
committed by Gerald (Jerry) Carter
parent 63ebaad393
commit efbcb0f741
2 changed files with 25 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
source/ldap_server/ldap_server.c
View File

@@ -40,11 +40,12 @@
static void ldapsrv_terminate_connection(struct ldapsrv_connection *conn,
const char *reason)
{
if (conn->tls) {
talloc_free(conn->tls);
conn->tls = NULL;
}
stream_terminate_connection(conn->connection, reason);
/* we don't actually do the stream termination here as the
recv/send functions dereference the connection after the
packet processing callbacks. Instead we mark it for
termination and do the real termination in the send/recv
functions */
conn->terminate = reason;
}
/*
@@ -299,6 +300,14 @@ static void ldapsrv_recv(struct stream_connection *c, uint16_t flags)
conn->processing = False;
EVENT_FD_READABLE(c->event.fde);
if (conn->terminate) {
if (conn->tls) {
talloc_free(conn->tls);
conn->tls = NULL;
}
stream_terminate_connection(conn->connection, conn->terminate);
}
}
/*
@@ -331,6 +340,14 @@ static void ldapsrv_send(struct stream_connection *c, uint16_t flags)
if (conn->send_queue == NULL) {
EVENT_FD_NOT_WRITEABLE(c->event.fde);
}
if (conn->terminate) {
if (conn->tls) {
talloc_free(conn->tls);
conn->tls = NULL;
}
stream_terminate_connection(conn->connection, conn->terminate);
}
}
/*