diff options
| author | Andreas Schneider <asn@samba.org> | 2010-06-16 11:44:36 +0200 |
|---|---|---|
| committer | Andreas Schneider <asn@samba.org> | 2010-06-16 12:03:46 +0200 |
| commit | 47ae4a518c5eb7c02d3f6c65f64d2ac490a90e83 (patch) | |
| tree | a9fc7a7ec7899ad42a9059a6c452232e0a52e63c | |
| parent | 18f3e5113ae18e120770ba93b0d36a7b176b0c52 (diff) | |
| download | samba-47ae4a518c5eb7c02d3f6c65f64d2ac490a90e83.tar.gz samba-47ae4a518c5eb7c02d3f6c65f64d2ac490a90e83.tar.bz2 samba-47ae4a518c5eb7c02d3f6c65f64d2ac490a90e83.zip | |
s3-spoolss: Provide a memory context for clean_up_driver_struct().
If we use a stack variable to setup spoolss_AddDriverInfoCtr this would
segfault with a talloc bad magic value.
| -rw-r--r-- | source3/include/proto.h | 3 | ||||
| -rw-r--r-- | source3/printing/nt_printing.c | 7 | ||||
| -rw-r--r-- | source3/rpc_server/srv_spoolss_nt.c | 2 |
3 files changed, 7 insertions, 5 deletions
diff --git a/source3/include/proto.h b/source3/include/proto.h index cd8d94261e..31a1d45a27 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -4750,7 +4750,8 @@ bool delete_a_form(nt_forms_struct **list, const char *del_name, int *count, WER void update_a_form(nt_forms_struct **list, struct spoolss_AddFormInfo1 *form, int count); int get_ntdrivers(fstring **list, const char *architecture, uint32 version); const char *get_short_archi(const char *long_archi); -WERROR clean_up_driver_struct(struct pipes_struct *rpc_pipe, +WERROR clean_up_driver_struct(TALLOC_CTX *mem_ctx, + struct pipes_struct *rpc_pipe, struct spoolss_AddDriverInfoCtr *r); WERROR move_driver_to_download_area(struct pipes_struct *p, struct spoolss_AddDriverInfoCtr *r, diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c index c87cfc1fe3..434311d665 100644 --- a/source3/printing/nt_printing.c +++ b/source3/printing/nt_printing.c @@ -1676,12 +1676,13 @@ static WERROR clean_up_driver_struct_level(TALLOC_CTX *mem_ctx, /**************************************************************************** ****************************************************************************/ -WERROR clean_up_driver_struct(struct pipes_struct *rpc_pipe, +WERROR clean_up_driver_struct(TALLOC_CTX *mem_ctx, + struct pipes_struct *rpc_pipe, struct spoolss_AddDriverInfoCtr *r) { switch (r->level) { case 3: - return clean_up_driver_struct_level(r, rpc_pipe, + return clean_up_driver_struct_level(mem_ctx, rpc_pipe, r->info.info3->architecture, &r->info.info3->driver_path, &r->info.info3->data_file, @@ -1690,7 +1691,7 @@ WERROR clean_up_driver_struct(struct pipes_struct *rpc_pipe, r->info.info3->dependent_files, &r->info.info3->version); case 6: - return clean_up_driver_struct_level(r, rpc_pipe, + return clean_up_driver_struct_level(mem_ctx, rpc_pipe, r->info.info6->architecture, &r->info.info6->driver_path, &r->info.info6->data_file, diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c index e03bb348ea..6fd369562a 100644 --- a/source3/rpc_server/srv_spoolss_nt.c +++ b/source3/rpc_server/srv_spoolss_nt.c @@ -7377,7 +7377,7 @@ WERROR _spoolss_AddPrinterDriverEx(pipes_struct *p, } DEBUG(5,("Cleaning driver's information\n")); - err = clean_up_driver_struct(p, r->in.info_ctr); + err = clean_up_driver_struct(p->mem_ctx, p, r->in.info_ctr); if (!W_ERROR_IS_OK(err)) goto done; |