Bugfix noticed by Herb. On using the again: tag as a

goto target we were not reinitializing the array counts.

From Herb:

This is in the file nsswitch/winbindd_cm.c (samba-3.0.30) line 1236

We have a label again: where we keep trying to find the name of the DC
from the list of IPs returned by get_dcs. If we fail to figure out the
name we do a goto again at the end of the function. The problem is we
don't reset the num_dcs, num_addrs, etc and free the memory in the
various arrays. This seems wrong to me. I have a winbindd core where
I have 9 IPs returned for the DCs but at the time of the crash num_dcs
is 87 and if I look through the array dcs it keeps repeating entries
from the same group of 9

Jerry, Volker and Guenther please check.

Jeremy.

diff --git a/source/nsswitch/winbindd_cm.c b/source/nsswitch/winbindd_cm.c
index 6eb096460aa720b36b35c9ee71f2357627422daa..8d303b3d4acbff73d7113b10210003207a182de1 100644 (file)
--- a/source/nsswitch/winbindd_cm.c
+++ b/source/nsswitch/winbindd_cm.c
@@ -1250,6 +1250,8 @@ static BOOL find_new_dc(TALLOC_CTX *mem_ctx,
 
        int i, fd_index;
 
 
        int i, fd_index;
 

+       *fd = -1;
+

  again:
        if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
                return False;
  again:
        if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
                return False;


@@ -1310,6 +1312,19 @@ static BOOL find_new_dc(TALLOC_CTX *mem_ctx,
        /* We can not continue without the DC's name */
        winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
                                    NT_STATUS_UNSUCCESSFUL);
        /* We can not continue without the DC's name */
        winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
                                    NT_STATUS_UNSUCCESSFUL);

+
+       /* Throw away all arrays as we're doing this again. */
+       TALLOC_FREE(dcs);
+       num_dcs = 0;
+
+       TALLOC_FREE(dcnames);
+       num_dcnames = 0;
+
+       TALLOC_FREE(addrs);
+       num_addrs = 0;
+
+       *fd = -1;
+

        goto again;
 }
 
        goto again;
 }