Don't double free call structure

If the rx_Read() of the number of bytes in the FetchData64 response
fails, then it sets code, and disposes of the call structure. However,
the length safety check that was added in
c7b92a3018044f7aca4d9a77644e5c06ef64d1e9 executes regardless of whether
code is set, and the call has already been freed. So we end up calling
rx_Error with a NULL call structure, and panic.

(pulled up from 806423be3c55f3de91c2b836d2088eeb0f4e4665)

Change-Id: Ia1ee4ab9c794db9337e4eb7b5b5980c8a57cef0b
Reviewed-on: http://gerrit.openafs.org/1113
Reviewed-by: Derrick Brashear <shadow@dementia.org>
Tested-by: Derrick Brashear <shadow@dementia.org>

diff --git a/src/afs/afs_dcache.c b/src/afs/afs_dcache.c
index f99191073baa1efa8152b77fdb40b9b66618ce79..c61211352b3b5aeb256e35a42baaea1ce0457284 100644 (file)
--- a/src/afs/afs_dcache.c
+++ b/src/afs/afs_dcache.c
@@ -2209,7 +2209,7 @@ afs_GetDCache(register struct vcache *avc, afs_size_t abyte,
                    }
 #endif /* AFS_64BIT_CLIENT */
 
-                   if (length > size) {
+                   if (code == 0 && length > size) {
                        /* The fileserver told us it is going to send more data
                         * than we requested. It shouldn't do that, and
                         * accepting that much data can make us take up more