Memory leak fixes.

Jeremy.
(This used to be commit 34b63896ab1543936d6b9b382ef6727a161b6bf2)

4 files changed, 19 insertions, 2 deletions

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 7f94fef7d7..65b84398c2 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -2443,6 +2443,7 @@ BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int depth
 BOOL make_systemtime(SYSTEMTIME *systime, struct tm *unixtime);
 BOOL smb_io_notify_info_data_strings(char *desc,SPOOL_NOTIFY_INFO_DATA *data,
                                      prs_struct *ps, int depth);
+void free_spoolss_devmode(DEVICEMODE *devmode);
 BOOL make_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u,
 		const fstring printername, 
 		const fstring datatype, 
@@ -2450,6 +2451,7 @@ BOOL make_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u,
 		const fstring clientname,
 		const fstring user_name);
 BOOL spoolss_io_q_open_printer_ex(char *desc, SPOOL_Q_OPEN_PRINTER_EX *q_u, prs_struct *ps, int depth);
+void free_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u);
 BOOL spoolss_io_r_open_printer_ex(char *desc, SPOOL_R_OPEN_PRINTER_EX *r_u, prs_struct *ps, int depth);
 BOOL spoolss_io_q_getprinterdata(char *desc, SPOOL_Q_GETPRINTERDATA *q_u, prs_struct *ps, int depth);
 BOOL spoolss_io_r_getprinterdata(char *desc, SPOOL_R_GETPRINTERDATA *r_u, prs_struct *ps, int depth);
diff --git a/source3/rpc_parse/parse_spoolss.c b/source3/rpc_parse/parse_spoolss.c
index 4530f638bc..ea8aa42a45 100644
--- a/source3/rpc_parse/parse_spoolss.c
+++ b/source3/rpc_parse/parse_spoolss.c
@@ -605,6 +605,15 @@ static BOOL spoolss_io_devmode(char *desc, prs_struct *ps, int depth, DEVICEMODE
 	return True;
 }
 
+void free_spoolss_devmode(DEVICEMODE *devmode)
+{
+	if (devmode == NULL)
+		return;
+
+	safe_free(devmode->private);
+	safe_free(devmode);
+}
+
 /*******************************************************************
  Read or write a DEVICEMODE container
 ********************************************************************/  
@@ -752,6 +761,11 @@ BOOL spoolss_io_q_open_printer_ex(char *desc, SPOOL_Q_OPEN_PRINTER_EX *q_u, prs_
 	return True;
 }
 
+void free_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u)
+{
+	free_spoolss_devmode(q_u->printer_default.devmode_cont.devmode);
+}
+
 /*******************************************************************
  * write a structure.
  * called from static spoolss_r_open_printer_ex (srv_spoolss.c)
diff --git a/source3/rpc_server/srv_spoolss.c b/source3/rpc_server/srv_spoolss.c
index c2839bfbf7..c259260385 100755
--- a/source3/rpc_server/srv_spoolss.c
+++ b/source3/rpc_server/srv_spoolss.c
@@ -52,7 +52,7 @@ static BOOL api_spoolss_open_printer_ex(prs_struct *data, prs_struct *rdata)
 	                                       &r_u.handle);
 
 	/* we _really_ need to switch to talloc() */
-	safe_free(q_u.printer_default.devmode_cont.devmode);
+	free_spoolss_q_open_printer_ex(&q_u);
 
 	if (!spoolss_io_r_open_printer_ex("",&r_u,rdata,0)){
 		DEBUG(0,("spoolss_io_r_open_printer_ex: unable to marshall SPOOL_R_OPEN_PRINTER_EX.\n"));
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index 5793d5a137..b341dbe12a 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -3109,7 +3109,8 @@ uint32 _spoolss_fcpn(const POLICY_HND *handle)
 	Printer->notify.options=0;
 	Printer->notify.localmachine[0]='\0';
 	Printer->notify.printerlocal=0;
-	safe_free(Printer->notify.option->ctr.type);
+	if (Printer->notify.option)
+		safe_free(Printer->notify.option->ctr.type);
 	safe_free(Printer->notify.option);
 	Printer->notify.option=NULL;