| commit | 234216c1e02dd45d35179235dcef57948b63abfd | |
| author | Andrew Bartlett <abartlet@samba.org> | |
| Thu, 3 May 2018 04:22:19 +0000 (3 16:22 +1200) | ||
| committer | Karolin Seeger <kseeger@samba.org> | |
| Mon, 14 May 2018 07:58:07 +0000 (14 09:58 +0200) | ||
| tree | 395a8e2b9f04a78021a7fdeb1827ed02fa4d490a | treesnapshot (tar.gz zip) |
| parent | 1b34b8691896dcfac6be604fdd354c2b2466efb8 | commitdiff |
s4-lsa: Fix use-after-free in LSA server
This is a regression introduced in ab7988aa2fd1a43f576a4b73a6893c61c7ef1957.
The state variable contains the data to be returned to the client
and packed into NDR after the function returned.
This memory needs to be kept (on mem_ctx as parent) until that is
pushed and freed by the caller.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13420
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 7e091e505156381e385235ab4518b4d133a98497)
This is a regression introduced in ab7988aa2fd1a43f576a4b73a6893c61c7ef1957.
The state variable contains the data to be returned to the client
and packed into NDR after the function returned.
This memory needs to be kept (on mem_ctx as parent) until that is
pushed and freed by the caller.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13420
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 7e091e505156381e385235ab4518b4d133a98497)
| source4/rpc_server/lsa/lsa_lookup.c | diffblobblamehistory |