Fix winbindd crash in an unusual failure mode. Bug #5737. Based on original patch...

Jeremy.

diff --git a/source/nsswitch/winbindd_dual.c b/source/nsswitch/winbindd_dual.c
index 396eca7beb389c181f06b01166b4ed3599f082f4..84c9a1c7b90425bd4c312b12fd7e87968fdd0be6 100644 (file)
--- a/source/nsswitch/winbindd_dual.c
+++ b/source/nsswitch/winbindd_dual.c
@@ -194,10 +194,12 @@ static void async_request_fail(struct winbindd_async_request *state)
 
        TALLOC_FREE(state->reply_timeout_event);
 
-       SMB_ASSERT(state->child_pid != (pid_t)0);
+       /* If child exists and is not already reaped,
+          send kill signal to child. */
 
-       /* If not already reaped, send kill signal to child. */
-       if (state->child->pid == state->child_pid) {
+       if ((state->child->pid != (pid_t)0) &&
+                       (state->child->pid != (pid_t)-1) &&
+                       (state->child->pid == state->child_pid)) {
                kill(state->child_pid, SIGTERM);
 
                /* 
@@ -293,12 +295,14 @@ static void schedule_async_request(struct winbindd_child *child)
        }
 
        if ((child->pid == 0) && (!fork_domain_child(child))) {
-               /* Cancel all outstanding requests */
+               /* fork_domain_child failed.
+                  Cancel all outstanding requests */
 
                while (request != NULL) {
                        /* request might be free'd in the continuation */
                        struct winbindd_async_request *next = request->next;
-                       request->continuation(request->private_data, False);
+
+                       async_request_fail(request);
                        request = next;
                }
                return;