tldap: Fix tldap_msg_received()

The callback of "req" might have destroyed "ld", we can't reference
this anymore after calling tevent_req_done(req). Defer calling the
callbacks, which also means that the callbacks can't have added
anything to ld->pending.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14465

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit f816ccb8f4d212fe7f6bf36f90cbb9297c899786)

diff --git a/source3/lib/tldap.c b/source3/lib/tldap.c
index 9da0e0c086e6a4b9c645bd020f80de5bdb85eed9..9274db126c465205d2da1f56458249212f5248c3 100644 (file)
--- a/source3/lib/tldap.c
+++ b/source3/lib/tldap.c
@@ -677,21 +677,13 @@ static void tldap_msg_received(struct tevent_req *subreq)
        tldap_msg_unset_pending(req);
        num_pending = talloc_array_length(ld->pending);
 
+       tevent_req_defer_callback(req, state->ev);
        tevent_req_done(req);
 
  done:
        if (num_pending == 0) {
                return;
        }
-       if (talloc_array_length(ld->pending) > num_pending) {
-               /*
-                * The callback functions called from tevent_req_done() above
-                * have put something on the pending queue. We don't have to
-                * trigger the read_ldap_send(), tldap_msg_set_pending() has
-                * done it for us already.
-                */
-               return;
-       }
 
        state = tevent_req_data(ld->pending[0], struct tldap_msg_state);
        subreq = read_ldap_send(ld->pending, state->ev, ld->conn);