[PATCH 2/2] s4-dsdb: Fix a use after free segfault.

[Andreas Schneider]

Signed-off-by: Andreas Schneider <asn at samba.org>
---
 source4/dsdb/samdb/ldb_modules/rootdse.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/source4/dsdb/samdb/ldb_modules/rootdse.c b/source4/dsdb/samdb/ldb_modules/rootdse.c
index f905aa2..7e1d277 100644
--- a/source4/dsdb/samdb/ldb_modules/rootdse.c
+++ b/source4/dsdb/samdb/ldb_modules/rootdse.c
@@ -1373,6 +1373,7 @@ static void rootdse_fsmo_transfer_callback(struct tevent_req *treq)
 	int ret;
 	struct ldb_request *req = fsmo->req;
 	struct ldb_context *ldb = fsmo->ldb;
+	struct ldb_module *module = fsmo->module;
 
 	status = dcerpc_drepl_takeFSMORole_recv(treq, fsmo, &werr);
 	talloc_free(fsmo);
@@ -1382,7 +1383,7 @@ static void rootdse_fsmo_transfer_callback(struct tevent_req *treq)
 		 * Now that it is failed, start the transaction up
 		 * again so the wrappers can close it without additional error
 		 */
-		ldb_next_start_trans(fsmo->module);
+		ldb_next_start_trans(module);
 		ldb_module_done(req, NULL, NULL, LDB_ERR_UNAVAILABLE);
 		return;
 	}
@@ -1392,7 +1393,7 @@ static void rootdse_fsmo_transfer_callback(struct tevent_req *treq)
 		 * Now that it is failed, start the transaction up
 		 * again so the wrappers can close it without additional error
 		 */
-		ldb_next_start_trans(fsmo->module);
+		ldb_next_start_trans(module);
 		ldb_module_done(req, NULL, NULL, LDB_ERR_UNAVAILABLE);
 		return;
 	}
@@ -1401,7 +1402,7 @@ static void rootdse_fsmo_transfer_callback(struct tevent_req *treq)
 	 * Now that it is done, start the transaction up again so the
 	 * wrappers can close it without error
 	 */
-	ret = ldb_next_start_trans(fsmo->module);
+	ret = ldb_next_start_trans(module);
 	ldb_module_done(req, NULL, NULL, ret);
 }
 
-- 
1.8.4