r18779: Not simo's fault, this is actually a bug I introduced a week ago, when I...

We need to remove fragments from the incoming fragment list, or else
we leak (actually, we walk free()'ed data as we add/remove elements).

Andrew Bartlett
(This used to be commit 77473d2ef9a7673cebb56b398acf390fd51a08c8)

diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index f74e52256449bc76833e0237b23b17f8a37a69b7..a78c424eaaa60c998f2cafa50807691414c579f7 100644 (file)
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -1056,7 +1056,10 @@ NTSTATUS dcesrv_input_process(struct dcesrv_connection *dce_conn)
                DLIST_ADD_END(dce_conn->incoming_fragmented_call_list, call, 
                              struct dcesrv_call_state *);
                return NT_STATUS_OK;
-       }
+       } 
+       
+       /* This removes any fragments we may have had stashed away */
+       DLIST_REMOVE(dce_conn->incoming_fragmented_call_list, call);
 
        switch (call->pkt.ptype) {
        case DCERPC_PKT_BIND: