lib: poll_funcs : poll_funcs_context_slot_find can select the wrong slot to replace.

Look for an exact match first, before a free slot.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12272

Back-port from 085542fc93b3c603e8cda6e481e94d5fe2dfc669

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

diff --git a/source3/lib/poll_funcs/poll_funcs_tevent.c b/source3/lib/poll_funcs/poll_funcs_tevent.c
index 6052077ff3f04772c6bbb7ff94be711987c1ec16..65adb2da8c272fe011e091eb645a9c73db247479 100644 (file)
--- a/source3/lib/poll_funcs/poll_funcs_tevent.c
+++ b/source3/lib/poll_funcs/poll_funcs_tevent.c
@@ -318,15 +318,27 @@ static bool poll_funcs_context_slot_find(struct poll_funcs_state *state,
        struct poll_funcs_tevent_context **contexts;
        unsigned i;
 
+       /* Look for an existing match first. */
        for (i=0; i<state->num_contexts; i++) {
                struct poll_funcs_tevent_context *ctx = state->contexts[i];
 
-               if ((ctx == NULL) || (ctx->ev == ev)) {
+               if (ctx != NULL && ctx->ev == ev) {
                        *slot = i;
                        return true;
                }
        }
 
+       /* Now look for a free slot. */
+       for (i=0; i<state->num_contexts; i++) {
+               struct poll_funcs_tevent_context *ctx = state->contexts[i];
+
+               if (ctx == NULL) {
+                       *slot = i;
+                       return true;
+               }
+       }
+
+
        contexts = talloc_realloc(state, state->contexts,
                                  struct poll_funcs_tevent_context *,
                                  state->num_contexts + 1);