r11635: fix a handling of packet_send in the smb client lib

[jelmer/samba4-debian.git] / source / libcli / raw / clitransport.c

diff --git a/source/libcli/raw/clitransport.c b/source/libcli/raw/clitransport.c
index bc00b19ef580dcdb57ff769f396f1a2bcd41d1bf..6bf79ecfb0ef30f829a87ad20442f89f089e46d5 100644 (file)
--- a/source/libcli/raw/clitransport.c
+++ b/source/libcli/raw/clitransport.c
@@ -559,7 +559,16 @@ void smbcli_transport_send(struct smbcli_request *req)
                return;
        }
 
-       /* put it on the socket queue */
+       /* put it on the socket queue
+        * - as the buffer is a part of the smbcli_request struct
+        *   we need to reference it here, because packet_queue_run()
+        *   will call talloc_free() on it
+        */
+       if (!talloc_reference(req, req->out.buffer)) {
+               req->state = SMBCLI_REQUEST_ERROR;
+               req->status = NT_STATUS_NO_MEMORY;
+               return;
+       }
        blob = data_blob_const(req->out.buffer, req->out.size);
        status = packet_send(req->transport->packet, blob);
        if (!NT_STATUS_IS_OK(status)) {