[SCM] CTDB repository - branch master updated - ctdb-1.0.113-105-g259054c

[Ronnie Sahlberg]

The branch, master has been updated
       via  259054c3632e42bbaa614ee7e888e6e850733d60 (commit)
      from  344b1f95b126ecabeb4576330038b08bf88e8cb8 (commit)

http://gitweb.samba.org/?p=sahlberg/ctdb.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 259054c3632e42bbaa614ee7e888e6e850733d60
Author: Ronnie Sahlberg <ronniesahlberg at gmail.com>
Date:   Tue Feb 23 12:43:49 2010 +1100

    In ctdb_control_end_recovery,
    
    We used to talloc_steal c (the command packet) and make it a child of the
    "event script state context".
    If we failed to create a eventscript child context for some reason,
    this would have talloc freed state, but at the same time it would also
    implicitely have freed c.
    Once ctdb_control_end_recovery() returns the error back to the caller,
    the caller would dereference both c, and also outdata which is a child of c
    and we would either read garbage data or segv.
    
    Change the ordering so we only talloc_steal c as a child of state IFF
    we have successfully created a child context for the script.
    
    BZ61068

-----------------------------------------------------------------------

Summary of changes:
 server/ctdb_recover.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)


Changeset truncated at 500 lines:

diff --git a/server/ctdb_recover.c b/server/ctdb_recover.c
index 9020363..ed5c22b 100644
--- a/server/ctdb_recover.c
+++ b/server/ctdb_recover.c
@@ -967,7 +967,7 @@ int32_t ctdb_control_end_recovery(struct ctdb_context *ctdb,
 	state = talloc(ctdb, struct recovery_callback_state);
 	CTDB_NO_MEMORY(ctdb, state);
 
-	state->c    = talloc_steal(state, c);
+	state->c    = c;
 
 	ctdb_disable_monitoring(ctdb);
 
@@ -986,6 +986,7 @@ int32_t ctdb_control_end_recovery(struct ctdb_context *ctdb,
 	}
 
 	/* tell the control that we will be reply asynchronously */
+	state->c    = talloc_steal(state, c);
 	*async_reply = true;
 	return 0;
 }


-- 
CTDB repository