svn commit: samba r10709 - in branches/SAMBA_4_0/source/ldap_server: .

[tridge at samba.org]

Author: tridge
Date: 2005-10-04 10:18:07 +0000 (Tue, 04 Oct 2005)
New Revision: 10709

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=10709

Log:

fixed a crash bug rather similar to the one volker found in the dcerpc
code, where a stream_terminate_connection() while processing a request
can cause a later defererence of the connection structure to die.


Modified:
   branches/SAMBA_4_0/source/ldap_server/ldap_server.c
   branches/SAMBA_4_0/source/ldap_server/ldap_server.h


Changeset:
Modified: branches/SAMBA_4_0/source/ldap_server/ldap_server.c
===================================================================
--- branches/SAMBA_4_0/source/ldap_server/ldap_server.c	2005-10-04 05:41:05 UTC (rev 10708)
+++ branches/SAMBA_4_0/source/ldap_server/ldap_server.c	2005-10-04 10:18:07 UTC (rev 10709)
@@ -40,11 +40,12 @@
 static void ldapsrv_terminate_connection(struct ldapsrv_connection *conn, 
 					 const char *reason)
 {
-	if (conn->tls) {
-		talloc_free(conn->tls);
-		conn->tls = NULL;
-	}
-	stream_terminate_connection(conn->connection, reason);
+	/* we don't actually do the stream termination here as the
+	   recv/send functions dereference the connection after the
+	   packet processing callbacks. Instead we mark it for
+	   termination and do the real termination in the send/recv
+	   functions */
+	conn->terminate = reason;
 }
 
 /*
@@ -299,6 +300,14 @@
 	conn->processing = False;
 
 	EVENT_FD_READABLE(c->event.fde);
+
+	if (conn->terminate) {
+		if (conn->tls) {
+			talloc_free(conn->tls);
+			conn->tls = NULL;
+		}
+		stream_terminate_connection(conn->connection, conn->terminate);
+	}
 }
 	
 /*
@@ -331,6 +340,14 @@
 	if (conn->send_queue == NULL) {
 		EVENT_FD_NOT_WRITEABLE(c->event.fde);
 	}
+
+	if (conn->terminate) {
+		if (conn->tls) {
+			talloc_free(conn->tls);
+			conn->tls = NULL;
+		}
+		stream_terminate_connection(conn->connection, conn->terminate);
+	}
 }
 
 /*

Modified: branches/SAMBA_4_0/source/ldap_server/ldap_server.h
===================================================================
--- branches/SAMBA_4_0/source/ldap_server/ldap_server.h	2005-10-04 05:41:05 UTC (rev 10708)
+++ branches/SAMBA_4_0/source/ldap_server/ldap_server.h	2005-10-04 10:18:07 UTC (rev 10709)
@@ -38,6 +38,9 @@
 	struct data_blob_list_item *send_queue;
 
 	BOOL processing;
+
+	/* connection should be terminated if non-null */
+	const char *terminate;
 };
 
 struct ldapsrv_call {