s4-dsdb: fixed use after free for RODC

diff --git a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
index 160f60f18c49b6f641d9ecb4678d3bbbb6d31178..5815e9158d172b2d5bbf38bcee5fdd04187623da 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+++ b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
@@ -2176,13 +2176,12 @@ static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
 
        ret = replmd_update_rpmd(module, ac->schema, req, msg, &ac->seq_num, t, &is_urgent);
        if (ret == LDB_ERR_REFERRAL) {
-               talloc_free(ac);
-
                referral = talloc_asprintf(req,
                                           "ldap://%s/%s",
                                           lpcfg_dnsdomain(lp_ctx),
                                           ldb_dn_get_linearized(msg->dn));
                ret = ldb_module_send_referral(req, referral);
+               talloc_free(ac);
                return ldb_module_done(req, NULL, NULL, ret);
        }