mirror of
https://github.com/samba-team/samba.git
synced 2025-02-04 17:47:26 +03:00
520bb70dfd
We are setting ldb_debug_string() as the ldb debug function. The context we give it is only valid as long as we're in that function. On failure, we jump to the teardown function. The pointer for debug_string isn't valid anymore, but the ldb debug system still points to that address, and when we store the location of the allocated string, we overwrite memory, in that case something from talloc and a talloc_free() then jumps into the nirvana. Thanks to Florian Weimer who helped debugging this. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Isaac Boukris <iboukris@samba.org>