| commit | 47b6ecaf953a3ed3edbdba04a25a32f0241af2c4 | |
| author | Amitay Isaacs <amitay@gmail.com> | |
| Wed, 13 Dec 2017 05:12:09 +0000 (13 16:12 +1100) | ||
| committer | Karolin Seeger <kseeger@samba.org> | |
| Tue, 2 Jan 2018 09:02:23 +0000 (2 10:02 +0100) | ||
| tree | 85d718a35391044df29e55d6ada9ba4bcab33f04 | treesnapshot (tar.gz zip) |
| parent | d983766eaf7ff93db5aa0ac478bbacdda8aef62d | commitdiff |
ctdb-recovery-helper: Deregister message handler in error paths
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13188
If PULL_DB control times out but the remote node is still sending the
data, then the tevent_req for pull_database_send will be freed without
removing the message handler. So when the data is received, srvid
handler will be called and it will try to access tevent_req which will
result in use-after-free and abort.
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13188
If PULL_DB control times out but the remote node is still sending the
data, then the tevent_req for pull_database_send will be freed without
removing the message handler. So when the data is received, srvid
handler will be called and it will try to access tevent_req which will
result in use-after-free and abort.
Signed-off-by: Amitay Isaacs <amitay@gmail.com>
Reviewed-by: Martin Schwenke <martin@meltin.net>
| ctdb/server/ctdb_recovery_helper.c | diffblobblamehistory |