id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc
259	Crash in NDCTL.EXE while browsing directory under PMView	Lewis Rosenthal		"Directory contains several nested directories of image files, and is located on !NetWare CIFS volume (SMB1). Browsing for several minutes, moving form one directory to another results in a crash. The relevant portion of log.smbc (I think) is:

{{{
[2015/07/13 09:25:19.777000,  3, pid=46, effective(0, 0), real(0, 0)] ../source3
/lib/util_sock.c:617(open_socket_out_send)
  Connecting to 192.168.100.1 at port 139
[2015/07/13 09:25:19.799000,  5, pid=46, effective(0, 0), real(0, 0)] ../lib/uti
l/util_net.c:890(print_socket_options)
  Socket options:
        SO_KEEPALIVE = 0
        SO_REUSEADDR = 0
        SO_BROADCAST = 0
        TCP_NODELAY = 4
        IPTOS_LOWDELAY = 0
        IPTOS_THROUGHPUT = 0
        Could not test socket option SO_REUSEPORT.
        SO_SNDBUF = 33580
        SO_RCVBUF = 33580
        SO_SNDLOWAT = 4096
        SO_RCVLOWAT = 1
        SO_SNDTIMEO = 0
        SO_RCVTIMEO = 0
[2015/07/13 09:25:19.801000,  4, pid=46, effective(0, 0), real(0, 0)] U:/DEV/sam
ba-svn/trunk/client-4.x/src/smbwrp.c:272(smbwrp_connect)
   session request ok, c->timeout = 20000
[2015/07/13 09:25:19.844000,  0, pid=46, effective(0, 0), real(0, 0)] ../lib/uti
l/talloc_stack.c:104(talloc_pop)
  Freed frame U:/DEV/samba-svn/trunk/client-4.x/src/smbwrp.c:1193, expected U:/D
EV/samba-svn/trunk/client-4.x/src/smbwrp.c:1193.
[2015/07/13 09:25:20.055000,  0, pid=46, effective(0, 0), real(0, 0)] ../lib/uti
l/debug.c:429(talloc_log_fn)
  talloc: access after free error - first free may be at U:/DEV/samba-svn/trunk/
client-4.x/src/smbwrp.c:1251
[2015/07/13 09:25:20.057000,  0, pid=46, effective(0, 0), real(0, 0)] ../lib/uti
l/debug.c:429(talloc_log_fn)
  Bad talloc magic value - access after free

Killed by SIGABRT
pid=0x002e ppid=0x0000 tid=0x0003 slot=0x0089 pri=0x0400 mc=0x0001 ps=0x0000
C:\NDFS\NDCTL.EXE
Process dumping was disabled, use DUMPPROC / PROCDUMP to enable it.
}}}

I have not tested with smbclient, yet, though I'm not sure I can even duplicate the conditions under smbclient (I can browse directories from a command line, but not from a file picker, as no drive letter mapping is possible with it)."	defect	closed	major		Samba Client Plugin	Client 3.0.x	fixed