Author: abartlet
Date: 2006-11-16 09:34:19 +0000 (Thu, 16 Nov 2006)
New Revision: 19732

WebSVN: 
http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=19732

Log:
The 'res' from ldb_search is only valid if the call returns LDB_SUCCESS.  

This seems to show up (as an abort() from talloc) particularly under
ldb_ildap.

Andrew Bartlett

Modified:
   branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/samldb.c
   branches/SAMBA_4_0/source/scripting/ejs/smbcalls_ldb.c


Changeset:
Modified: branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/samldb.c
===================================================================
--- branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/samldb.c   2006-11-16 
09:16:17 UTC (rev 19731)
+++ branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/samldb.c   2006-11-16 
09:34:19 UTC (rev 19732)
@@ -200,9 +200,12 @@
        do {
                ret = ldb_search(module->ldb, sdn, LDB_SCOPE_BASE, 
                                 
"(|(objectClass=domain)(objectClass=builtinDomain))", attrs, &res);
-               talloc_steal(local_ctx, res);
-               if (ret == LDB_SUCCESS && res->count == 1)
-                       break;
+               if (ret == LDB_SUCCESS) {
+                       talloc_steal(local_ctx, res);
+                       if (res->count == 1) {
+                               break;
+                       }
+               }
        } while ((sdn = ldb_dn_get_parent(local_ctx, sdn)));
 
        if (ret != LDB_SUCCESS || res->count != 1) {

Modified: branches/SAMBA_4_0/source/scripting/ejs/smbcalls_ldb.c
===================================================================
--- branches/SAMBA_4_0/source/scripting/ejs/smbcalls_ldb.c      2006-11-16 
09:16:17 UTC (rev 19731)
+++ branches/SAMBA_4_0/source/scripting/ejs/smbcalls_ldb.c      2006-11-16 
09:34:19 UTC (rev 19732)
@@ -111,8 +111,8 @@
                mpr_Return(eid, mprCreateUndefinedVar());
        } else {
                mpr_Return(eid, mprLdbArray(ldb, res->msgs, res->count, 
"ldb_message"));
+               talloc_free(res);
        }
-       talloc_free(res);
        talloc_free(tmp_ctx);
        return 0;
 

Reply via email to