lib: talloc: Fix bug when calling a destructor.

If the destructor itself calls talloc_set_destructor()
and returns -1, the new destructor set is overwritten
by talloc.

Dectect that and leave the new destructor in place.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
(cherry picked from commit 3289a5d84f73bf044e5767a6c47a3f7bf8357c08)

diff --git a/lib/talloc/talloc.c b/lib/talloc/talloc.c
index fa56ea5678061a21c7e38f25ed5463921d79e761..1ccb039ff7448f56f67d7b69620fae3d46e420d7 100644 (file)
--- a/lib/talloc/talloc.c
+++ b/lib/talloc/talloc.c
@@ -991,7 +991,13 @@ static inline int _talloc_free_internal(void *ptr, const char *location)
                }
                tc->destructor = (talloc_destructor_t)-1;
                if (d(ptr) == -1) {
-                       tc->destructor = d;
+                       /*
+                        * Only replace the destructor pointer if
+                        * calling the destructor didn't modify it.
+                        */
+                       if (tc->destructor == (talloc_destructor_t)-1) {
+                               tc->destructor = d;
+                       }
                        return -1;
                }
                tc->destructor = NULL;