diff options
| author | Volker Lendecke <vl@samba.org> | 2013-11-14 21:30:49 +0100 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2013-11-20 00:13:50 +0100 |
| commit | 2d91577f984bc83c2c87141cfdda87d068060b32 (patch) | |
| tree | 7fcc5cb38291e19f0a1b9055d1c1218c9c08fada | |
| parent | 4503bdf560f0e9461ac4eb1fe6220f6440c10fd3 (diff) | |
| download | samba-2d91577f984bc83c2c87141cfdda87d068060b32.tar.gz samba-2d91577f984bc83c2c87141cfdda87d068060b32.tar.xz samba-2d91577f984bc83c2c87141cfdda87d068060b32.zip | |
smbd: Fix a talloc hierarchy problem in msg_channel
When tearing down a watch_send with an open tevent_immediate, we
talloc_free the msg_channel while the tevent_immediate still references
it. Don't make the tevent_immediate outlive the msg_channel.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10250
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Wed Nov 20 00:13:51 CET 2013 on sn-devel-104
| -rw-r--r-- | source3/lib/msg_channel.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source3/lib/msg_channel.c b/source3/lib/msg_channel.c index 537b162737..625d07c135 100644 --- a/source3/lib/msg_channel.c +++ b/source3/lib/msg_channel.c @@ -244,7 +244,7 @@ struct tevent_req *msg_read_send(TALLOC_CTX *mem_ctx, num_msgs = talloc_array_length(channel->msgs); if (num_msgs != 0) { - im = tevent_create_immediate(channel->ev); + im = tevent_create_immediate(channel); if (tevent_req_nomem(im, req)) { return tevent_req_post(req, ev); } |