Fix use of DLIST_REMOVE as spotted by Constantine Vetoshev <gepardcv@gmail.com>.

This API is unusual in that if used to remove a non-list head it nulls out
the next and prev pointers. This is what you want for debugging (don't want
an entry removed from the list to be still virtually linked into it) but
means there is no consistent idiom for use as the next and prev pointers
get trashed on removal from the list, meaning you must save them yourself.
You can use it one way when deleting everything via the head pointer, as
this preserves the next pointer, but you *must* use it another way when not
deleting everything via the head pointer. Fix all known uses of this (the main
one is in conn_free_internal() and would not free all the private data entries
for vfs modules. The other changes in web/statuspage.c and winbindd_util.c
are not strictly neccessary, as the head pointer is being used, but I've done
them for consistency. Long term we must revisit this as this API is too hard
to use correctly.
Jeremy.

diff --git a/source3/smbd/conn.c b/source3/smbd/conn.c
index b9433bb96580385a7312efe1e2afec17dc2941de..7f34d2b8e2b3e9d1971c2bd9cb9a9e5057b1c32c 100644 (file)
--- a/source3/smbd/conn.c
+++ b/source3/smbd/conn.c
@@ -252,8 +252,8 @@ void conn_free_internal(connection_struct *conn)
        /* Free vfs_connection_struct */
        handle = conn->vfs_handles;
        while(handle) {
-               DLIST_REMOVE(conn->vfs_handles, handle);
                thandle = handle->next;
+               DLIST_REMOVE(conn->vfs_handles, handle);
                if (handle->free_data)
                        handle->free_data(&handle->data);
                handle = thandle;

diff --git a/source3/web/statuspage.c b/source3/web/statuspage.c
index ce24c7cddd480dd71f10c128834ded9264bd3d66..e684a075c25228762bdccf994dfdebdca84a32b1 100644 (file)
--- a/source3/web/statuspage.c
+++ b/source3/web/statuspage.c
@@ -43,9 +43,10 @@ static void initPid2Machine (void)
 {
        /* show machine name rather PID on table "Open Files"? */
        if (PID_or_Machine) {
-               PIDMAP *p;
+               PIDMAP *p, *next;
 
-               for (p = pidmap; p != NULL; ) {
+               for (p = pidmap; p != NULL; p = next) {
+                       next = p->next;
                        DLIST_REMOVE(pidmap, p);
                        SAFE_FREE(p->machine);
                        SAFE_FREE(p);

diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
index b8cb27c797420fe691ef3d4a38b87511ccc53ffd..fdfc8ed9d13dd3d076efa461d270da73d150b8ff 100644 (file)
--- a/source3/winbindd/winbindd_util.c
+++ b/source3/winbindd/winbindd_util.c
@@ -1075,13 +1075,12 @@ void free_getent_state(struct getent_state *state)
        temp = state;
 
        while(temp != NULL) {
-               struct getent_state *next;
+               struct getent_state *next = temp->next;
 
                /* Free sam entries then list entry */
 
                SAFE_FREE(state->sam_entries);
                DLIST_REMOVE(state, state);
-               next = temp->next;
 
                SAFE_FREE(temp);
                temp = next;