Fix bug #7020 - smbd using 2G memory.

When deferring an async pipe writeX and readX transfer
the outstanding request struct onto the conn struct. This
needs freeing after the packet is finally processed.

Jeremy.

diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c
index bf64c59afdaab9486df4d31eedcaecc92ab4b8d5..9bc3fdfdf6d46ae3797b219c8a7c4da90236ad25 100644 (file)
--- a/source3/smbd/pipes.c
+++ b/source3/smbd/pipes.c
@@ -353,6 +353,11 @@ static void pipe_write_andx_done(struct tevent_req *subreq)
 
  done:
        chain_reply(req);
+       /*
+        * We must free here as the ownership of req was
+        * moved to the connection struct in reply_pipe_write_and_X().
+        */
+       TALLOC_FREE(req);
 }
 
 /****************************************************************************
@@ -458,4 +463,9 @@ static void pipe_read_andx_done(struct tevent_req *subreq)
 
  done:
        chain_reply(req);
+       /*
+        * We must free here as the ownership of req was
+        * moved to the connection struct in reply_pipe_read_and_X().
+        */
+       TALLOC_FREE(req);
 }