[SCM] Samba Shared Repository - branch v3-4-test updated

Karolin Seeger kseeger at samba.org
Thu Apr 8 03:45:42 MDT 2010


The branch, v3-4-test has been updated
       via  c150cf2... Second part of fix for bug #7159 - client rpc_transport doesn't cope with bad server data returns.
       via  0223d59... First part of fix for bug #7159 - client rpc_transport doesn't cope with bad server data returns.
      from  d232dd9... s3: Fix bug 7326 -- can't write with vfs_full_audit active

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-test


- Log -----------------------------------------------------------------
commit c150cf25f1aa5f034baa08360d5be9b8b532b7cb
Author: Jeremy Allison <jra at samba.org>
Date:   Fri Feb 19 14:24:17 2010 -0800

    Second part of fix for bug #7159 - client rpc_transport doesn't cope with bad server data returns.
    
    If server returns zero on a NP read. Report pipe broken.
    Prevents client from looping if it thinks there should be
    more data.
    
    Jeremy.
    (cherry picked from commit 0055e33dbed0e81548464d01bcf864255bab3159)
    (cherry picked from commit f5ca9f84e9b511c2ba7a4280b1997daa441f9877)
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

commit 0223d59ea950c8180047fd5de6c85f92c4e37ad2
Author: Stefan Metzmacher <metze at samba.org>
Date:   Tue Apr 6 12:20:02 2010 +0200

    First part of fix for bug #7159 - client rpc_transport doesn't cope with bad server data returns.
    
    Ensure that subreq is *always* talloc_free'd in the _done
    function, as it has an event timeout attached. If the
    read requests look longer than the cli->timeout, then
    the timeout fn is called with already freed data.
    
    Jeremy.
    (cherry picked from commit ad77ae1d5870e06f8587ecf634e0b6bdcbb950d7)
    (similar to commit 6e5b6b5acb30869eb63b25ed1406014101a5e89d)
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 source3/rpc_client/rpc_transport_np.c   |   10 ++++++++++
 source3/rpc_client/rpc_transport_sock.c |   12 ++++++++++++
 2 files changed, 22 insertions(+), 0 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/rpc_client/rpc_transport_np.c b/source3/rpc_client/rpc_transport_np.c
index 80ff384..4ea361b 100644
--- a/source3/rpc_client/rpc_transport_np.c
+++ b/source3/rpc_client/rpc_transport_np.c
@@ -159,6 +159,9 @@ static void rpc_np_read_done(struct async_req *subreq)
 	NTSTATUS status;
 	uint8_t *rcvbuf;
 
+	/* We must free subreq in this function as there is
+	   a timer event attached to it. */
+
 	status = cli_read_andx_recv(subreq, &state->received, &rcvbuf);
 	/*
 	 * We can't TALLOC_FREE(subreq) as usual here, as rcvbuf still is a
@@ -179,7 +182,14 @@ static void rpc_np_read_done(struct async_req *subreq)
 		return;
 	}
 
+	if (state->received == 0) {
+		TALLOC_FREE(subreq);
+		async_req_nterror(req, NT_STATUS_PIPE_BROKEN);
+		return;
+	}
+
 	memcpy(state->data, rcvbuf, state->received);
+	TALLOC_FREE(subreq);
 	async_req_done(req);
 }
 
diff --git a/source3/rpc_client/rpc_transport_sock.c b/source3/rpc_client/rpc_transport_sock.c
index b1d9d8f..7115dc4 100644
--- a/source3/rpc_client/rpc_transport_sock.c
+++ b/source3/rpc_client/rpc_transport_sock.c
@@ -76,11 +76,17 @@ static void rpc_sock_read_done(struct tevent_req *subreq)
 		req->private_data, struct rpc_sock_read_state);
 	int err;
 
+	/* We must free subreq in this function as there is
+	  a timer event attached to it. */
+
 	state->received = async_recv_recv(subreq, &err);
+
 	if (state->received == -1) {
+		TALLOC_FREE(subreq);
 		async_req_nterror(req, map_nt_error_from_unix(err));
 		return;
 	}
+	TALLOC_FREE(subreq);
 	async_req_done(req);
 }
 
@@ -137,11 +143,17 @@ static void rpc_sock_write_done(struct tevent_req *subreq)
 		req->private_data, struct rpc_sock_write_state);
 	int err;
 
+	/* We must free subreq in this function as there is
+	  a timer event attached to it. */
+
 	state->sent = async_send_recv(subreq, &err);
+
 	if (state->sent == -1) {
+		TALLOC_FREE(subreq);
 		async_req_nterror(req, map_nt_error_from_unix(err));
 		return;
 	}
+	TALLOC_FREE(subreq);
 	async_req_done(req);
 }
 


-- 
Samba Shared Repository


More information about the samba-cvs mailing list