The branch, master has been updated via 6d2c8f5 smbd: Fix a use-after-free from aa2a6c7 s3: smbd: Preparation for leases code merge. Ensure VFS is ready for 4.2.0.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit 6d2c8f54e5e87485783b5173aa9f903a79d25443 Author: Volker Lendecke <v...@samba.org> Date: Fri Oct 10 11:40:14 2014 +0200 smbd: Fix a use-after-free We can't reference xconn->next after it was talloc_free'ed Signed-off-by: Volker Lendecke <v...@samba.org> Reviewed-by: Stefan Metzmacher <me...@samba.org> Autobuild-User(master): Stefan Metzmacher <me...@samba.org> Autobuild-Date(master): Fri Oct 10 14:32:53 CEST 2014 on sn-devel-104 ----------------------------------------------------------------------- Summary of changes: source3/smbd/server_exit.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) Changeset truncated at 500 lines: diff --git a/source3/smbd/server_exit.c b/source3/smbd/server_exit.c index d48a8f2..6a51c24 100644 --- a/source3/smbd/server_exit.c +++ b/source3/smbd/server_exit.c @@ -218,7 +218,10 @@ static void exit_server_common(enum server_exit_reason how, * because smbd_msg_ctx is not a talloc child of smbd_server_conn. */ if (client != NULL) { - for (; xconn != NULL; xconn = xconn->next) { + struct smbXsrv_connection *next; + + for (; xconn != NULL; xconn = next) { + next = xconn->next; DLIST_REMOVE(client->connections, xconn); talloc_free(xconn); } -- Samba Shared Repository