s3: fix crash in winbindd (similar to commit f8cc0e88fbbb082ead023e0cb437b1e12cf35459)

Signed-off-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source3/libsmb/async_smb.c b/source3/libsmb/async_smb.c
index e5ff0026a3dae2b04f7dcaf0285cbc0bc9a3c1d7..e5f5c6f04c3ad35adf52c1fbcee3966d5e6726a3 100644 (file)
--- a/source3/libsmb/async_smb.c
+++ b/source3/libsmb/async_smb.c
@@ -1019,6 +1019,11 @@ static void cli_state_handler(struct event_context *event_ctx,
 
        DEBUG(11, ("cli_state_handler called with flags %d\n", flags));
 
+       if (cli->fd == -1) {
+               status = NT_STATUS_CONNECTION_INVALID;
+               goto sock_error;
+       }
+
        if (flags & EVENT_FD_WRITE) {
                size_t to_send;
                ssize_t sent;
@@ -1132,6 +1137,8 @@ static void cli_state_handler(struct event_context *event_ctx,
                }
        }
        TALLOC_FREE(cli->fd_event);
-       close(cli->fd);
-       cli->fd = -1;
+       if (cli->fd != -1) {
+               close(cli->fd);
+               cli->fd = -1;
+       }
 }

diff --git a/source3/rpc_client/rpc_transport_np.c b/source3/rpc_client/rpc_transport_np.c
index 4ea361bc2a8508b1dbc5ba9f1ee17b6c7b234d02..ed639d0e6f8ba582a49b95586c9e4e8680180267 100644 (file)
--- a/source3/rpc_client/rpc_transport_np.c
+++ b/source3/rpc_client/rpc_transport_np.c
@@ -31,6 +31,12 @@ struct rpc_transport_np_state {
 static int rpc_transport_np_state_destructor(struct rpc_transport_np_state *s)
 {
        bool ret;
+
+       if (s->cli->fd == -1) {
+               DEBUG(10, ("socket was closed, no need to send close request.\n"));
+               return 0;
+       }
+       
        ret = cli_close(s->cli, s->fnum);
        if (!ret) {
                DEBUG(1, ("rpc_transport_np_state_destructor: cli_close "