Fix smbd crash for close_on_completion

handle_trans() can talloc_free "conn" if the client requests
close_on_completion. "state" is a talloc_child of conn, so it will be gone when
we later free state->data et al.

diff --git a/source/smbd/ipc.c b/source/smbd/ipc.c
index a53bc5bea2aea6ae9c0101063704476044f93eeb..8e40c30210eb7d475261a4baaeb2b2b9f00a2cf2 100644 (file)
--- a/source/smbd/ipc.c
+++ b/source/smbd/ipc.c
@@ -658,6 +658,8 @@ void reply_trans(struct smb_request *req)
                return;
        }
 
+       talloc_steal(talloc_tos(), state);
+
        handle_trans(conn, req, state);
 
        SAFE_FREE(state->data);
@@ -787,6 +789,8 @@ void reply_transs(struct smb_request *req)
          */
         SCVAL(req->inbuf,smb_com,SMBtrans);
 
+       talloc_steal(talloc_tos(), state);
+
        handle_trans(conn, req, state);
 
        DLIST_REMOVE(conn->pending_trans, state);