s4-dsdb: Fix a use after free segfault.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Tue Nov 12 19:22:28 CET 2013 on sn-devel-104

diff --git a/source4/dsdb/samdb/ldb_modules/rootdse.c b/source4/dsdb/samdb/ldb_modules/rootdse.c
index f905aa24230a08e680669c86e09427f8e8668d64..7e1d2770a5f8f3a558ac6ab6b1f1de2d3a427725 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/rootdse.c
+++ b/source4/dsdb/samdb/ldb_modules/rootdse.c
@@ -1373,6 +1373,7 @@ static void rootdse_fsmo_transfer_callback(struct tevent_req *treq)
        int ret;
        struct ldb_request *req = fsmo->req;
        struct ldb_context *ldb = fsmo->ldb;
+       struct ldb_module *module = fsmo->module;
 
        status = dcerpc_drepl_takeFSMORole_recv(treq, fsmo, &werr);
        talloc_free(fsmo);
@@ -1382,7 +1383,7 @@ static void rootdse_fsmo_transfer_callback(struct tevent_req *treq)
                 * Now that it is failed, start the transaction up
                 * again so the wrappers can close it without additional error
                 */
-               ldb_next_start_trans(fsmo->module);
+               ldb_next_start_trans(module);
                ldb_module_done(req, NULL, NULL, LDB_ERR_UNAVAILABLE);
                return;
        }
@@ -1392,7 +1393,7 @@ static void rootdse_fsmo_transfer_callback(struct tevent_req *treq)
                 * Now that it is failed, start the transaction up
                 * again so the wrappers can close it without additional error
                 */
-               ldb_next_start_trans(fsmo->module);
+               ldb_next_start_trans(module);
                ldb_module_done(req, NULL, NULL, LDB_ERR_UNAVAILABLE);
                return;
        }
@@ -1401,7 +1402,7 @@ static void rootdse_fsmo_transfer_callback(struct tevent_req *treq)
         * Now that it is done, start the transaction up again so the
         * wrappers can close it without error
         */
-       ret = ldb_next_start_trans(fsmo->module);
+       ret = ldb_next_start_trans(module);
        ldb_module_done(req, NULL, NULL, ret);
 }