smbd: Fix a memleak in async search ask sharemode

fetch_share_mode_unlocked_parser() takes a "struct
fetch_share_mode_unlocked_state *" as
"private_data". fetch_share_mode_send() used a talloc_zero'ed "struct
share_mode_lock". This lead to the parser putting a "struct
share_mode_lock on the NULL talloc_context where nobody really picked it
up.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13602
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

diff --git a/source3/locking/share_mode_lock.c b/source3/locking/share_mode_lock.c
index 0bf7b9db90a874ae4239088669b7946dbc7bc496..90723fb4243f3463a29bb1538fb61caad7f208c8 100644 (file)
--- a/source3/locking/share_mode_lock.c
+++ b/source3/locking/share_mode_lock.c
@@ -663,7 +663,7 @@ static void fetch_share_mode_done(struct tevent_req *subreq);
 struct fetch_share_mode_state {
        struct file_id id;
        TDB_DATA key;
-       struct share_mode_lock *lck;
+       struct fetch_share_mode_unlocked_state parser_state;
        enum dbwrap_req_state req_state;
 };
 
@@ -711,17 +711,14 @@ struct tevent_req *fetch_share_mode_send(TALLOC_CTX *mem_ctx,
 
        state->id = id;
        state->key = locking_key(&state->id);
-       state->lck = talloc_zero(state, struct share_mode_lock);
-       if (tevent_req_nomem(state->lck, req)) {
-               return tevent_req_post(req, ev);
-       }
+       state->parser_state.mem_ctx = state;
 
        subreq = dbwrap_parse_record_send(state,
                                          ev,
                                          lock_db,
                                          state->key,
                                          fetch_share_mode_unlocked_parser,
-                                         state->lck,
+                                         &state->parser_state,
                                          &state->req_state);
        if (tevent_req_nomem(subreq, req)) {
                return tevent_req_post(req, ev);
@@ -765,12 +762,12 @@ NTSTATUS fetch_share_mode_recv(struct tevent_req *req,
                return status;
        }
 
-       if (state->lck->data == NULL) {
+       if (state->parser_state.lck->data == NULL) {
                tevent_req_received(req);
                return NT_STATUS_NOT_FOUND;
        }
 
-       lck = talloc_move(mem_ctx, &state->lck);
+       lck = talloc_move(mem_ctx, &state->parser_state.lck);
 
        if (DEBUGLEVEL >= 10) {
                DBG_DEBUG("share_mode_data:\n");