librpc/rpc/binding_handle.c remember missing

diff --git a/librpc/rpc/binding_handle.c b/librpc/rpc/binding_handle.c
index 24b063904685757f439aabc01b2a6ae21558f006..76c8bfce2ec166116c056d97b4a7468e595753ff 100644 (file)
--- a/librpc/rpc/binding_handle.c
+++ b/librpc/rpc/binding_handle.c
@@ -455,6 +455,7 @@ struct dcerpc_binding_handle_call_params_state {
        struct tevent_req *subreq;
        DATA_BLOB response;
        struct ndr_pull *pull;
+       uint32_t pull_missing;
 
        struct dcerpc_pipe_handle *ph;
        struct dcerpc_pipe_handle_connection *pc;
@@ -827,6 +828,8 @@ static void dcerpc_binding_handle_call_params_done(struct tevent_req *subreq)
                        dcerpc_binding_handle_call_params_cleanup(req);
                        return;
                }
+               state->pull_missing -= MIN(state->pull_missing, state->response.length);
+               data_blob_free(&state->response);
        }
 
        if (state->out_pipe_idx != UINT32_MAX) {
@@ -1142,6 +1145,10 @@ static void dcerpc_binding_handle_call_params_pull_notify(struct tevent_req *req
                return;
        }
 
+       if (call_state->pull_missing > 0) {
+               return;
+       }
+
        /*
         * setup a shallow copy subcontext, which we might destroy
         */
@@ -1160,6 +1167,7 @@ static void dcerpc_binding_handle_call_params_pull_notify(struct tevent_req *req
                                                  NDR_SCALARS|NDR_BUFFERS,
                                                  state->chunk_ptr);
        if (ndr_err == NDR_ERR_INCOMPLETE_BUFFER) {
+               call_state->pull_missing = pipe_pull->relative_highest_offset;
                TALLOC_FREE(pipe_pull);
                talloc_free_children(state->chunk_mem);
                return;