librpc/rpc/binding_handle.c remember missing

diff --git a/librpc/rpc/binding_handle.c b/librpc/rpc/binding_handle.c
index d32a83081522026fd8faddcf6b5cad7f14943add..c9c880bc77afec48cbd074f7a9b304fd91172c34 100644 (file)
--- a/librpc/rpc/binding_handle.c
+++ b/librpc/rpc/binding_handle.c
@@ -463,6 +463,7 @@ struct dcerpc_binding_handle_call_params_state {
        struct tevent_req *subreq;
        DATA_BLOB response;
        struct ndr_pull *pull;
+       uint32_t pull_missing;
 
        struct dcerpc_pipe_handle *ph;
        struct dcerpc_pipe_handle_connection *pc;
@@ -833,6 +834,8 @@ static void dcerpc_binding_handle_call_params_done(struct tevent_req *subreq)
                        dcerpc_binding_handle_call_params_cleanup(req);
                        return;
                }
+               state->pull_missing -= MIN(state->pull_missing, state->response.length);
+               data_blob_free(&state->response);
        }
 
        if (state->out_pipe_idx != UINT32_MAX) {
@@ -1148,6 +1151,10 @@ static void dcerpc_binding_handle_call_params_pull_notify(struct tevent_req *req
                return;
        }
 
+       if (call_state->pull_missing > 0) {
+               return;
+       }
+
        /*
         * setup a shallow copy subcontext, which we might destroy
         */
@@ -1166,6 +1173,7 @@ static void dcerpc_binding_handle_call_params_pull_notify(struct tevent_req *req
                                                  NDR_SCALARS|NDR_BUFFERS,
                                                  state->chunk_ptr);
        if (ndr_err == NDR_ERR_INCOMPLETE_BUFFER) {
+               call_state->pull_missing = pipe_pull->relative_highest_offset;
                TALLOC_FREE(pipe_pull);
                talloc_free_children(state->chunk_mem);
                return;