Fix bug #7020 - smbd using 2G memory.

When deferring an async pipe writeX and readX transfer
the outstanding request struct onto the conn struct. This
needs freeing after the packet is finally processed.

Jeremy.
(cherry picked from commit cabe8f0ee859013d49fba011a5a9ac0112d7b001)

diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c
index 2686cf41d93a30137e44c260270a49f66bf323bd..878d1710734ea7334e745069f225338d0ada922c 100644 (file)
--- a/source3/smbd/pipes.c
+++ b/source3/smbd/pipes.c
@@ -326,6 +326,11 @@ static void pipe_write_andx_done(struct tevent_req *subreq)
 
  done:
        chain_reply(req);
+       /*
+        * We must free here as the ownership of req was
+        * moved to the connection struct in reply_pipe_write_and_X().
+        */
+       TALLOC_FREE(req);
 }
 
 /****************************************************************************
@@ -431,4 +436,9 @@ static void pipe_read_andx_done(struct tevent_req *subreq)
 
  done:
        chain_reply(req);
+       /*
+        * We must free here as the ownership of req was
+        * moved to the connection struct in reply_pipe_read_and_X().
+        */
+       TALLOC_FREE(req);
 }