Fix bug 6774 - smbd crashes if "aio write behind" is set.

Don't dereference a talloc_move'd pointer.

Jeremy.

diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c
index e5e522c2694dc9f4de371083c9b4ed051df14de1..ab986752e8de7ffa736deabdbf4a37b36e206501 100644 (file)
--- a/source3/smbd/aio.c
+++ b/source3/smbd/aio.c
@@ -299,7 +299,7 @@ bool schedule_aio_write_and_X(connection_struct *conn,
                show_msg(aio_ex->outbuf);
                if (!srv_send_smb(smbd_server_fd(),aio_ex->outbuf,
                                IS_CONN_ENCRYPTED(fsp->conn),
-                               &req->pcd)) {
+                               &aio_ex->req->pcd)) {
                        exit_server_cleanly("handle_aio_write: srv_send_smb "
                                            "failed.");
                }