sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-12 20:58:37 +03:00
Code

tldap: Fix tldap_msg_received()

Browse Source 
The callback of "req" might have destroyed "ld", we can't reference
this anymore after calling tevent_req_done(req). Defer calling the
callbacks, which also means that the callbacks can't have added
anything to ld->pending.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
This commit is contained in:
Volker Lendecke 2020-08-11 16:54:34 +02:00
parent b85dbc9ccf
commit f816ccb8f4
1 changed files with 1 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
source3/lib/tldap.c
View File

@ -677,21 +677,13 @@ static void tldap_msg_received(struct tevent_req *subreq)
tldap_msg_unset_pending(req);
num_pending = talloc_array_length(ld->pending);
tevent_req_defer_callback(req, state->ev);
tevent_req_done(req);
done:
if (num_pending == 0) {
return;
}
if (talloc_array_length(ld->pending) > num_pending) {
/*
* The callback functions called from tevent_req_done() above
* have put something on the pending queue. We don't have to
* trigger the read_ldap_send(), tldap_msg_set_pending() has
* done it for us already.
*/
return;
}
state = tevent_req_data(ld->pending[0], struct tldap_msg_state);
subreq = read_ldap_send(ld->pending, state->ev, ld->conn);