Ensure we don't leak any sign records on cancel of pending requests.

Jeremy.

diff --git a/source/libsmb/smb_signing.c b/source/libsmb/smb_signing.c
index c3fc3306fe39d2918f5f41da887563b9a59b69e7..4167452953985698e50b0172e449e9d8a17c1b37 100644 (file)
--- a/source/libsmb/smb_signing.c
+++ b/source/libsmb/smb_signing.c
@@ -809,11 +809,38 @@ void srv_defer_sign_response(uint16 mid)
 
        data = (struct smb_basic_signing_context *)srv_sign_info.signing_context;
 
+       if (!data)
+               return;
+
        store_sequence_for_reply(&data->outstanding_packet_list, 
                                 mid, data->send_seq_num);
        data->send_seq_num++;
 }
 
+/***********************************************************
+ Called to remove sequence records when a deferred packet is
+ cancelled by mid. This should never find one....
+************************************************************/
+
+void srv_cancel_sign_response(uint16 mid)
+{
+       struct smb_basic_signing_context *data;
+       uint32 dummy_seq;
+
+       if (!srv_sign_info.doing_signing)
+               return;
+
+       data = (struct smb_basic_signing_context *)srv_sign_info.signing_context;
+
+       if (!data)
+               return;
+
+       DEBUG(10,("srv_cancel_sign_response: for mid %u\n", (unsigned int)mid ));
+
+       while (get_sequence_for_reply(&data->outstanding_packet_list, mid, &dummy_seq))
+               ;
+}
+
 /***********************************************************
  Called by server negprot when signing has been negotiated.
 ************************************************************/

diff --git a/source/smbd/notify.c b/source/smbd/notify.c
index e7903719ada697a84e6af2115ac4e0c20aa7a7c4..9adf827c794d79d43fda49c8ea957d2febfec2d5 100644 (file)
--- a/source/smbd/notify.c
+++ b/source/smbd/notify.c
@@ -44,6 +44,7 @@ static struct change_notify *change_notify_list;
 /****************************************************************************
  Setup the common parts of the return packet and send it.
 *****************************************************************************/
+
 static void change_notify_reply_packet(char *inbuf, NTSTATUS error_code)
 {
        char outbuf[smb_size+38];

diff --git a/source/smbd/nttrans.c b/source/smbd/nttrans.c
index 1506877affcc1f3b07679640c454485f597dd84e..3ffa6efa77a693a0f4829d3aa8ad6878c244b750 100644 (file)
--- a/source/smbd/nttrans.c
+++ b/source/smbd/nttrans.c
@@ -1443,6 +1443,7 @@ int reply_ntcancel(connection_struct *conn,
        START_PROFILE(SMBntcancel);
        remove_pending_change_notify_requests_by_mid(mid);
        remove_pending_lock_requests_by_mid(mid);
+       srv_cancel_sign_response(mid);
        
        DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", mid));