lib/ldb Remove talloc_free() that causes double-free in callbacks.
authorAndrew Bartlett <abartlet@samba.org>
Thu, 16 Dec 2010 11:28:45 +0000 (22:28 +1100)
committerAndrew Bartlett <abartlet@samba.org>
Sat, 18 Dec 2010 00:34:18 +0000 (01:34 +0100)
This partially reverts 0941099a, which was a little over-eager in
fixing what were presumed to be memory leaks.

It is always the callbacks responsiblity to free the ares, but if they
don't then the end of the request should handle the cleanup.
Attempting to talloc_free() here will result (as it did in the
descriptor module) in a double-free error if the callback does free
it, and no other caller of ldb_module_send_entry() has this behaviour.

Andrew Bartlett

source4/lib/ldb/ldb_tdb/ldb_index.c

index 71cffb90b3449aae7cf23bffb62423db3bb0fe9c..02e4acbbdef9ecd0e89da7d20de026a6a1ad8895 100644 (file)
@@ -966,7 +966,9 @@ static int ltdb_index_filter(const struct dn_list *dn_list,
 
                ret = ldb_module_send_entry(ac->req, msg, NULL);
                if (ret != LDB_SUCCESS) {
-                       talloc_free(msg);
+                       /* Regardless of success or failure, the msg
+                        * is the callbacks responsiblity, and should
+                        * not be talloc_free()'ed */
                        ac->request_terminated = true;
                        return ret;
                }