Fix bug #7020 - smbd using 2G memory.

When deferring an async pipe writeX and readX transfer
the outstanding request struct onto the conn struct. This
needs freeing after the packet is finally processed.

Jeremy.

1 files changed, 10 insertions, 0 deletions

diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c
index bf64c59afda..9bc3fdfdf6d 100644
--- a/source3/smbd/pipes.c
+++ b/source3/smbd/pipes.c
@@ -353,6 +353,11 @@ static void pipe_write_andx_done(struct tevent_req *subreq)
 
  done:
 	chain_reply(req);
+	/*
+	 * We must free here as the ownership of req was
+	 * moved to the connection struct in reply_pipe_write_and_X().
+	 */
+	TALLOC_FREE(req);
 }
 
 /****************************************************************************
@@ -458,4 +463,9 @@ static void pipe_read_andx_done(struct tevent_req *subreq)
 
  done:
 	chain_reply(req);
+	/*
+	 * We must free here as the ownership of req was
+	 * moved to the connection struct in reply_pipe_read_and_X().
+	 */
+	TALLOC_FREE(req);
 }