r13747: Fix the reference count for tdbsam_open() - on an

upgrade it calls tdbsam_convert() which calls tdbsam_open()
deep inside the init_sam_from_buffer_vX call.
If the ref count hasn't been set yet then we will close
the tdbsam reference in tdbsam_getsampwsid().
smbpasswd -a was core-dumping again :-).
Jeremy

1 files changed, 9 insertions, 5 deletions

diff --git a/source/passdb/pdb_tdb.c b/source/passdb/pdb_tdb.c
index fdf22d9c428..b38ebe436a7 100644
--- a/source/passdb/pdb_tdb.c
+++ b/source/passdb/pdb_tdb.c
@@ -817,17 +817,24 @@ static BOOL tdbsam_open( const char *name )
 		return False;
 	}
 
+	/* set the initial reference count - must be done before tdbsam_convert
+	   as that calls tdbsam_open()/tdbsam_close(). */
+
+	ref_count = 1;
+
 	/* Check the version */
 	version = tdb_fetch_int32( tdbsam, TDBSAM_VERSION_STRING );
 	
-	if (version == -1)
+	if (version == -1) {
 		version = 0;	/* Version not found, assume version 0 */
+	}
 	
 	/* Compare the version */
 	if (version > TDBSAM_VERSION) {
 		/* Version more recent than the latest known */ 
 		DEBUG(0, ("tdbsam_open: unknown version => %d\n", version));
 		tdb_close( tdbsam );
+		ref_count = 0;
 		return False;
 	} 
 	
@@ -839,16 +846,13 @@ static BOOL tdbsam_open( const char *name )
 		if ( !tdbsam_convert(version) ) {
 			DEBUG(0, ("tdbsam_open: Error when trying to convert tdbsam [%s]\n",name));
 			tdb_close(tdbsam);
+			ref_count = 0;
 			return False;
 		}
 			
 		DEBUG(3, ("TDBSAM converted successfully.\n"));
 	}
 	
-	/* set the initial reference count */
-
-	ref_count = 1;
-
 	DEBUG(4,("tdbsam_open: successfully opened %s\n", name ));	
 	
 	return True;