lib: poll_funcs : poll_funcs_context_slot_find can select the wrong slot to replace.

Look for an exact match first, before a free slot.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12272

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Mon Sep 19 07:12:00 CEST 2016 on sn-devel-144

diff --git a/lib/poll_funcs/poll_funcs_tevent.c b/lib/poll_funcs/poll_funcs_tevent.c
index 233e9110a4714a6cb57d32bd4d78d3b59b2e5e80..4dd09a23bda04330f659372b9bc52389f56fbdd6 100644 (file)
--- a/lib/poll_funcs/poll_funcs_tevent.c
+++ b/lib/poll_funcs/poll_funcs_tevent.c
@@ -504,10 +504,21 @@ static bool poll_funcs_context_slot_find(struct poll_funcs_state *state,
        size_t num_contexts = talloc_array_length(state->contexts);
        size_t i;
 
+       /* Look for an existing match first. */
        for (i=0; i<num_contexts; i++) {
                struct poll_funcs_tevent_context *ctx = state->contexts[i];
 
-               if ((ctx == NULL) || (ctx->ev == ev)) {
+               if (ctx != NULL && ctx->ev == ev) {
+                       *slot = i;
+                       return true;
+               }
+       }
+
+       /* Now look for a free slot. */
+       for (i=0; i<num_contexts; i++) {
+               struct poll_funcs_tevent_context *ctx = state->contexts[i];
+
+               if (ctx == NULL) {
                        *slot = i;
                        return true;
                }