[SCM] Samba Shared Repository - branch master updated - tevent-0-9-8-297-g33160b1

[Andrew Tridgell]

The branch, master has been updated
       via  33160b1a5b2bc498f0dfb5c59d0ec0592cc37e8d (commit)
       via  3cf73dfdbdd33189e0f9f22e0e494962376f9b86 (commit)
      from  667b825d183f6b438b2329aef32686c20e55b7d3 (commit)

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 33160b1a5b2bc498f0dfb5c59d0ec0592cc37e8d
Author: Andrew Tridgell <tridge at samba.org>
Date:   Mon Sep 14 03:44:10 2009 -0700

    s4-repl: fixed a memory error handling linked attributes
    
    We could get a double free with multiple linked attributes in a
    message

commit 3cf73dfdbdd33189e0f9f22e0e494962376f9b86
Author: Andrew Tridgell <tridge at samba.org>
Date:   Mon Sep 14 03:43:26 2009 -0700

    s4-repl: fall back to repsFrom if repsTo not set
    
    Windows does not seem to be always setting up repsTo using
    DsUpdateRefs(). For now we will fall back to using repsFrom if repsTo
    is empty. This is almost certainly incorrect, but it does get
    notification based replication working with both w2k3 and w2k8.

-----------------------------------------------------------------------

Summary of changes:
 source4/dsdb/repl/drepl_notify.c                |    6 ++++--
 source4/dsdb/samdb/ldb_modules/repl_meta_data.c |   20 ++++++++++----------
 2 files changed, 14 insertions(+), 12 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source4/dsdb/repl/drepl_notify.c b/source4/dsdb/repl/drepl_notify.c
index 83c6df4..7328091 100644
--- a/source4/dsdb/repl/drepl_notify.c
+++ b/source4/dsdb/repl/drepl_notify.c
@@ -293,13 +293,16 @@ static WERROR dreplsrv_notify_check(struct dreplsrv_service *s,
 				    struct dreplsrv_partition *p,
 				    TALLOC_CTX *mem_ctx)
 {
-	uint32_t count;
+	uint32_t count=0;
 	struct repsFromToBlob *reps;
 	WERROR werr;
 	uint64_t uSN;
 	int ret, i;
 
 	werr = dsdb_loadreps(s->samdb, mem_ctx, p->dn, "repsTo", &reps, &count);
+	if (count == 0) {
+		werr = dsdb_loadreps(s->samdb, mem_ctx, p->dn, "repsFrom", &reps, &count);
+	}
 	if (!W_ERROR_IS_OK(werr)) {
 		DEBUG(0,(__location__ ": Failed to load repsTo for %s\n",
 			 ldb_dn_get_linearized(p->dn)));
@@ -331,7 +334,6 @@ static WERROR dreplsrv_notify_check(struct dreplsrv_service *s,
 		}
 	}
 
-
 	return WERR_OK;
 }
 
diff --git a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
index 3afe11a..b9323b9 100644
--- a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+++ b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
@@ -47,6 +47,7 @@
 #include "lib/util/dlinklist.h"
 
 struct replmd_private {
+	TALLOC_CTX *la_ctx;
 	struct la_entry *la_list;
 	uint32_t num_ncs;
 	struct nc_entry {
@@ -1896,13 +1897,10 @@ static int replmd_extended_replicated_objects(struct ldb_module *module, struct
 	for (i=0; i<ar->objs->linked_attributes_count; i++) {
 		struct la_entry *la_entry;
 
-		if (replmd_private->la_list) {
-			la_entry = talloc(replmd_private->la_list,
-					  struct la_entry);
-		} else {
-			la_entry = talloc(replmd_private,
-					  struct la_entry);
+		if (replmd_private->la_ctx == NULL) {
+			replmd_private->la_ctx = talloc_new(replmd_private);
 		}
+		la_entry = talloc(replmd_private->la_ctx, struct la_entry);
 		if (la_entry == NULL) {
 			ldb_oom(ldb);
 			return LDB_ERR_OPERATIONS_ERROR;
@@ -2108,8 +2106,9 @@ static int replmd_start_transaction(struct ldb_module *module)
 	int i;
 	struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
 								struct replmd_private);
-	talloc_free(replmd_private->la_list);
+	talloc_free(replmd_private->la_ctx);
 	replmd_private->la_list = NULL;
+	replmd_private->la_ctx = NULL;
 
 	for (i=0; i<replmd_private->num_ncs; i++) {
 		replmd_private->ncs[i].mod_usn = 0;
@@ -2138,14 +2137,14 @@ static int replmd_prepare_commit(struct ldb_module *module)
 		prev = la->prev;
 		DLIST_REMOVE(replmd_private->la_list, la);
 		ret = replmd_process_linked_attribute(module, la);
-		talloc_free(la);
 		if (ret != LDB_SUCCESS) {
 			return ret;
 		}
 	}
 
-	talloc_free(replmd_private->la_list);
+	talloc_free(replmd_private->la_ctx);
 	replmd_private->la_list = NULL;
+	replmd_private->la_ctx = NULL;
 
 	/* possibly change @REPLCHANGED */
 	ret = replmd_notify_store(module);
@@ -2160,8 +2159,9 @@ static int replmd_del_transaction(struct ldb_module *module)
 {
 	struct replmd_private *replmd_private = 
 		talloc_get_type(ldb_module_get_private(module), struct replmd_private);
-	talloc_free(replmd_private->la_list);
+	talloc_free(replmd_private->la_ctx);
 	replmd_private->la_list = NULL;
+	replmd_private->la_ctx = NULL;
 	return ldb_next_del_trans(module);
 }
 


-- 
Samba Shared Repository