ctdb-common: Fix use-after-free error in comm_fd_handler()
authorAmitay Isaacs <amitay@gmail.com>
Mon, 6 Feb 2017 04:54:55 +0000 (15:54 +1100)
committerMartin Schwenke <martins@samba.org>
Thu, 16 Feb 2017 04:26:08 +0000 (05:26 +0100)
commit9db7785fc6ffbaad434ee189c0f46c488358aab5
treedfc573d1416937bbf4dcfec88e16ab67e7c0cf46
parent07bbd7fb449fbe64a682c4e6b0cf93fe91006a2e
ctdb-common: Fix use-after-free error in comm_fd_handler()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12580

comm_write_send() creates a new tevent_req and adds it to the queue
of requests to be processed.  If this tevent_req is freed, then the
queue entry is not removed causing use-after-free error.

If the tevent_req returned by comm_write_send() is freed, then that
request should be removed from the queue and any pending actions based
on that request should also be removed.

Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
ctdb/common/comm.c