svn commit: samba r17012 - in branches/SAMBA_4_0/source/smb_server: smb smb2

[metze at samba.org]

Author: metze
Date: 2006-07-13 15:46:36 +0000 (Thu, 13 Jul 2006)
New Revision: 17012

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=17012

Log:
don't try to send any data when the socket is gone already...
(fixes crash bugs)

metze
Modified:
   branches/SAMBA_4_0/source/smb_server/smb/request.c
   branches/SAMBA_4_0/source/smb_server/smb2/receive.c


Changeset:
Modified: branches/SAMBA_4_0/source/smb_server/smb/request.c
===================================================================
--- branches/SAMBA_4_0/source/smb_server/smb/request.c	2006-07-13 15:37:58 UTC (rev 17011)
+++ branches/SAMBA_4_0/source/smb_server/smb/request.c	2006-07-13 15:46:36 UTC (rev 17012)
@@ -289,6 +289,7 @@
 
 	if (req->smb_conn->connection->event.fde == NULL) {
 		/* we are in the process of shutting down this connection */
+		talloc_free(req);
 		return;
 	}
 
@@ -312,6 +313,11 @@
 */
 void smbsrv_send_reply(struct smbsrv_request *req)
 {
+	if (req->smb_conn->connection->event.fde == NULL) {
+		/* we are in the process of shutting down this connection */
+		talloc_free(req);
+		return;
+	}
 	smbsrv_sign_packet(req);
 
 	smbsrv_send_reply_nosign(req);

Modified: branches/SAMBA_4_0/source/smb_server/smb2/receive.c
===================================================================
--- branches/SAMBA_4_0/source/smb_server/smb2/receive.c	2006-07-13 15:37:58 UTC (rev 17011)
+++ branches/SAMBA_4_0/source/smb_server/smb2/receive.c	2006-07-13 15:46:36 UTC (rev 17012)
@@ -26,6 +26,7 @@
 #include "smb_server/smb_server.h"
 #include "smb_server/service_smb_proto.h"
 #include "smb_server/smb2/smb2_server.h"
+#include "smbd/service_stream.h"
 #include "lib/stream/packet.h"
 
 
@@ -98,6 +99,12 @@
 	DATA_BLOB blob;
 	NTSTATUS status;
 
+	if (req->smb_conn->connection->event.fde == NULL) {
+		/* the socket has been destroyed - no point trying to send a reply! */
+		talloc_free(req);
+		return;
+	}
+
 	if (req->out.size > NBT_HDR_SIZE) {
 		_smb2_setlen(req->out.buffer, req->out.size - NBT_HDR_SIZE);
 	}
@@ -114,6 +121,12 @@
 {
 	NTSTATUS status;
 
+	if (req->smb_conn->connection->event.fde == NULL) {
+		/* the socket has been destroyed - no point trying to send an error! */
+		talloc_free(req);
+		return;
+	}
+
 	status = smb2srv_setup_reply(req, 8, True, 0);
 	if (!NT_STATUS_IS_OK(status)) {
 		smbsrv_terminate_connection(req->smb_conn, nt_errstr(status));