[SCM] Samba Shared Repository - branch master updated

[Stefan Metzmacher]

The branch, master has been updated
       via  6d2c8f5 smbd: Fix a use-after-free
      from  aa2a6c7 s3: smbd: Preparation for leases code merge. Ensure VFS is ready for 4.2.0.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 6d2c8f54e5e87485783b5173aa9f903a79d25443
Author: Volker Lendecke <vl at samba.org>
Date:   Fri Oct 10 11:40:14 2014 +0200

    smbd: Fix a use-after-free
    
    We can't reference xconn->next after it was talloc_free'ed
    
    Signed-off-by: Volker Lendecke <vl at samba.org>
    Reviewed-by: Stefan Metzmacher <metze at samba.org>
    
    Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
    Autobuild-Date(master): Fri Oct 10 14:32:53 CEST 2014 on sn-devel-104

-----------------------------------------------------------------------

Summary of changes:
 source3/smbd/server_exit.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/smbd/server_exit.c b/source3/smbd/server_exit.c
index d48a8f2..6a51c24 100644
--- a/source3/smbd/server_exit.c
+++ b/source3/smbd/server_exit.c
@@ -218,7 +218,10 @@ static void exit_server_common(enum server_exit_reason how,
 	 * because smbd_msg_ctx is not a talloc child of smbd_server_conn.
 	 */
 	if (client != NULL) {
-		for (; xconn != NULL; xconn = xconn->next) {
+		struct smbXsrv_connection *next;
+
+		for (; xconn != NULL; xconn = next) {
+			next = xconn->next;
 			DLIST_REMOVE(client->connections, xconn);
 			talloc_free(xconn);
 		}


-- 
Samba Shared Repository