Bugfix noticed by Herb. On using the again: tag as a

goto target we were not reinitializing the array counts.

From Herb:

This is in the file nsswitch/winbindd_cm.c (samba-3.0.30) line 1236

We have a label again: where we keep trying to find the name of the DC
from the list of IPs returned by get_dcs. If we fail to figure out the
name we do a goto again at the end of the function. The problem is we
don't reset the num_dcs, num_addrs, etc and free the memory in the
various arrays. This seems wrong to me. I have a winbindd core where
I have 9 IPs returned for the DCs but at the time of the crash num_dcs
is 87 and if I look through the array dcs it keeps repeating entries
from the same group of 9

Jerry, Volker and Guenther please check.

Jeremy.

diff --git a/source/winbindd/winbindd_cm.c b/source/winbindd/winbindd_cm.c
index ae51c268bd7a179a7ac29e651b157df250f55427..860fabbf721e004664cf36260e70712bbc65a7df 100644 (file)
--- a/source/winbindd/winbindd_cm.c
+++ b/source/winbindd/winbindd_cm.c
@@ -1257,6 +1257,8 @@ static bool find_new_dc(TALLOC_CTX *mem_ctx,
 
        int i, fd_index;
 
+       *fd = -1;
+
  again:
        if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
                return False;
@@ -1318,6 +1320,19 @@ static bool find_new_dc(TALLOC_CTX *mem_ctx,
        /* We can not continue without the DC's name */
        winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
                                    NT_STATUS_UNSUCCESSFUL);
+
+       /* Throw away all arrays as we're doing this again. */
+       TALLOC_FREE(dcs);
+       num_dcs = 0;
+
+       TALLOC_FREE(dcnames);
+       num_dcnames = 0;
+       
+       TALLOC_FREE(addrs);
+       num_addrs = 0;
+
+       *fd = -1;
+
        goto again;
 }