Bugfix noticed by Herb. On using the again: tag as a

goto target we were not reinitializing the array counts.

From Herb:

This is in the file nsswitch/winbindd_cm.c (samba-3.0.30) line 1236

We have a label again: where we keep trying to find the name of the DC
from the list of IPs returned by get_dcs. If we fail to figure out the
name we do a goto again at the end of the function. The problem is we
don't reset the num_dcs, num_addrs, etc and free the memory in the
various arrays. This seems wrong to me. I have a winbindd core where
I have 9 IPs returned for the DCs but at the time of the crash num_dcs
is 87 and if I look through the array dcs it keeps repeating entries
from the same group of 9

Jerry, Volker and Guenther please check.

Jeremy.
(cherry picked from commit 0b2062a499c69c86cc03130542aaf3e92265b65d)

1 files changed, 15 insertions, 0 deletions

diff --git a/source/winbindd/winbindd_cm.c b/source/winbindd/winbindd_cm.c
index 25f59db245d..9bfe1dec86c 100644
--- a/source/winbindd/winbindd_cm.c
+++ b/source/winbindd/winbindd_cm.c
@@ -1251,6 +1251,8 @@ static bool find_new_dc(TALLOC_CTX *mem_ctx,
 
 	int i, fd_index;
 
+	*fd = -1;
+
  again:
 	if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
 		return False;
@@ -1312,6 +1314,19 @@ static bool find_new_dc(TALLOC_CTX *mem_ctx,
 	/* We can not continue without the DC's name */
 	winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
 				    NT_STATUS_UNSUCCESSFUL);
+
+	/* Throw away all arrays as we're doing this again. */
+	TALLOC_FREE(dcs);
+	num_dcs = 0;
+
+	TALLOC_FREE(dcnames);
+	num_dcnames = 0;
+	
+	TALLOC_FREE(addrs);
+	num_addrs = 0;
+
+	*fd = -1;
+
 	goto again;
 }