Fix for a signing bug when the mid wraps.

Found by Fran Fabrizio <fran@cis.uab.edu>.
Add to the *start* of the list not the end of the list.
This ensures that the *last* send sequence with this mid
is returned by preference.
This can happen if the mid wraps and one of the early
mid numbers didn't get a reply and is still lurking on
the list.
Jeremy.
(This used to be commit b84d249e67315c153e0aa3c5c9adfcf6ca008f97)

diff --git a/source3/libsmb/smb_signing.c b/source3/libsmb/smb_signing.c
index 8a056f659fb1b5060c9f2ba435c0909407b138cb..9010dbf5cb28e64c4e06f60884e41b74617e8392 100644 (file)
--- a/source3/libsmb/smb_signing.c
+++ b/source3/libsmb/smb_signing.c
@@ -46,15 +46,23 @@ static void store_sequence_for_reply(struct outstanding_packet_lookup **list,
                                     uint16 mid, uint32 reply_seq_num)
 {
        struct outstanding_packet_lookup *t;
-       struct outstanding_packet_lookup *tmp;
-       
+
        t = smb_xmalloc(sizeof(*t));
        ZERO_STRUCTP(t);
 
-       DLIST_ADD_END(*list, t, tmp);
        t->mid = mid;
        t->reply_seq_num = reply_seq_num;
 
+       /*
+        * Add to the *start* of the list not the end of the list.
+        * This ensures that the *last* send sequence with this mid
+        * is returned by preference.
+        * This can happen if the mid wraps and one of the early
+        * mid numbers didn't get a reply and is still lurking on
+        * the list. JRA. Found by Fran Fabrizio <fran@cis.uab.edu>.
+        */
+
+       DLIST_ADD(*list, t);
        DEBUG(10,("store_sequence_for_reply: stored seq = %u mid = %u\n",
                        (unsigned int)reply_seq_num, (unsigned int)mid ));
 }