commit f6bd654a6c878111f0f0f4d07adb644fc3bbf224
Author: Jeremy Allison <jra@samba.org>
Date:   Tue Jan 5 14:34:00 2010 -0800

    Fix bug #7020 - smbd using 2G memory.
    
    When deferring an async pipe writeX and readX transfer
    the outstanding request struct onto the conn struct. This
    needs freeing after the packet is finally processed.
    
    Jeremy.

Index: source3/smbd/pipes.c
===================================================================
--- source3/smbd/pipes.c.orig
+++ source3/smbd/pipes.c
@@ -326,6 +326,11 @@ static void pipe_write_andx_done(struct
 
  done:
 	chain_reply(req);
+	/*
+	 * We must free here as the ownership of req was
+	 * moved to the connection struct in reply_pipe_write_and_X().
+	 */
+	TALLOC_FREE(req);
 }
 
 /****************************************************************************
@@ -431,4 +436,9 @@ static void pipe_read_andx_done(struct t
 
  done:
 	chain_reply(req);
+	/*
+	 * We must free here as the ownership of req was
+	 * moved to the connection struct in reply_pipe_read_and_X().
+	 */
+	TALLOC_FREE(req);
 }
