lsa_PrivilegeSet seems to be a very strange beast indeed. It has a

constant sized array of size 1 at the end?
(This used to be commit 2cc354bd82456cb5598eb4acb40a5ada1459d08d)

6 files changed, 62 insertions, 23 deletions

diff --git a/source4/librpc/idl/lsa.idl b/source4/librpc/idl/lsa.idl
index fb572ae522..38f66f37e6 100644
--- a/source4/librpc/idl/lsa.idl
+++ b/source4/librpc/idl/lsa.idl
@@ -335,12 +335,12 @@
 	typedef struct {
 		uint32 count;
 		[size_is(count)] lsa_LUIDAttribute set[*];
+		uint32 unknown[1];
 	} lsa_PrivilegeSet;
 	
 	NTSTATUS lsa_EnumPrivsAccount (
 		[in,ref]     policy_handle *handle,
-		[out]        lsa_PrivilegeSet *privs,
-		[out]        uint32 unknown
+		[out]        lsa_PrivilegeSet *privs
 		);
 
 
diff --git a/source4/librpc/ndr/libndr.h b/source4/librpc/ndr/libndr.h
index d6d2655ef8..da262af00c 100644
--- a/source4/librpc/ndr/libndr.h
+++ b/source4/librpc/ndr/libndr.h
@@ -65,6 +65,7 @@ struct ndr_print {
 	TALLOC_CTX *mem_ctx;
 	uint32 depth;
 	void (*print)(struct ndr_print *, const char *, ...);
+	void *private;
 };
 
 #define LIBNDR_FLAG_BIGENDIAN 1
@@ -119,3 +120,4 @@ typedef void (*ndr_print_union_fn_t)(struct ndr_print *, const char *, uint16, v
 #include "librpc/ndr/ndr_misc.h"
 #include "librpc/ndr/ndr_echo.h"
 #include "librpc/ndr/ndr_lsa.h"
+#include "librpc/ndr/ndr_dfs.h"
diff --git a/source4/librpc/ndr/ndr.c b/source4/librpc/ndr/ndr.c
index 6401523028..eebc2ac681 100644
--- a/source4/librpc/ndr/ndr.c
+++ b/source4/librpc/ndr/ndr.c
@@ -167,7 +167,10 @@ NTSTATUS ndr_push_expand(struct ndr_push *ndr, uint32 size)
 		return NT_STATUS_OK;
 	}
 
-	ndr->alloc_size = size;
+	ndr->alloc_size += NDR_BASE_MARSHALL_SIZE;
+	if (size > ndr->alloc_size) {
+		ndr->alloc_size = size;
+	}
 	ndr->data = talloc_realloc(ndr->mem_ctx, ndr->data, ndr->alloc_size);
 	if (!ndr->data) {
 		return NT_STATUS_NO_MEMORY;
@@ -189,13 +192,12 @@ NTSTATUS ndr_push_set_offset(struct ndr_push *ndr, uint32 ofs)
 /*
   push a generic array
 */
-NTSTATUS ndr_push_array(struct ndr_push *ndr, int ndr_flags, void *base, 
-			size_t elsize, uint32 count, 
-			NTSTATUS (*push_fn)(struct ndr_push *, int, void *))
+NTSTATUS ndr_push_const_array(struct ndr_push *ndr, int ndr_flags, void *base, 
+			      size_t elsize, uint32 count, 
+			      NTSTATUS (*push_fn)(struct ndr_push *, int, void *))
 {
 	int i;
 	char *p = base;
-	NDR_CHECK(ndr_push_uint32(ndr, count));
 	if (!(ndr_flags & NDR_SCALARS)) goto buffers;
 	for (i=0;i<count;i++) {
 		NDR_CHECK(push_fn(ndr, NDR_SCALARS, p));
@@ -213,21 +215,26 @@ done:
 }
 
 /*
-  pull a generic array
+  push a generic array
 */
-NTSTATUS ndr_pull_array(struct ndr_pull *ndr, int ndr_flags, void *base, 
+NTSTATUS ndr_push_array(struct ndr_push *ndr, int ndr_flags, void *base, 
 			size_t elsize, uint32 count, 
-			NTSTATUS (*pull_fn)(struct ndr_pull *, int, void *))
+			NTSTATUS (*push_fn)(struct ndr_push *, int, void *))
+{
+	NDR_CHECK(ndr_push_uint32(ndr, count));
+	return ndr_push_const_array(ndr, ndr_flags, base, elsize, count, push_fn);
+}
+
+/*
+  pull a constant sized array
+*/
+NTSTATUS ndr_pull_const_array(struct ndr_pull *ndr, int ndr_flags, void *base, 
+			      size_t elsize, uint32 count, 
+			      NTSTATUS (*pull_fn)(struct ndr_pull *, int, void *))
 {
 	int i;
-	uint32 max_count;
 	char *p;
 	p = base;
-	NDR_CHECK(ndr_pull_uint32(ndr, &max_count));
-	if (max_count != count) {
-		/* maybe we can cope with this? */
-		return NT_STATUS_INVALID_PARAMETER;
-	}
 	if (!(ndr_flags & NDR_SCALARS)) goto buffers;
 	for (i=0;i<count;i++) {
 		NDR_CHECK(pull_fn(ndr, NDR_SCALARS, p));
@@ -244,6 +251,23 @@ done:
 	return NT_STATUS_OK;
 }
 
+/*
+  pull a generic array
+*/
+NTSTATUS ndr_pull_array(struct ndr_pull *ndr, int ndr_flags, void *base, 
+			size_t elsize, uint32 count, 
+			NTSTATUS (*pull_fn)(struct ndr_pull *, int, void *))
+{
+	uint32 max_count;
+	NDR_CHECK(ndr_pull_uint32(ndr, &max_count));
+	if (max_count != count) {
+		/* maybe we can cope with this? */
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+	return ndr_pull_const_array(ndr, ndr_flags, base, elsize, count, pull_fn);
+}
+
+
 
 /*
   print a generic array
diff --git a/source4/librpc/ndr/ndr_basic.c b/source4/librpc/ndr/ndr_basic.c
index a906e0c05b..f1996b55f7 100644
--- a/source4/librpc/ndr/ndr_basic.c
+++ b/source4/librpc/ndr/ndr_basic.c
@@ -151,19 +151,28 @@ NTSTATUS ndr_pull_array_uint16(struct ndr_pull *ndr, uint16 *data, uint32 n)
 }
 
 /*
+  pull a const array of uint32
+*/
+NTSTATUS ndr_pull_const_array_uint32(struct ndr_pull *ndr, uint32 *data, uint32 n)
+{
+	uint32 i;
+	for (i=0;i<n;i++) {
+		NDR_CHECK(ndr_pull_uint32(ndr, &data[i]));
+	}
+	return NT_STATUS_OK;
+}
+
+/*
   pull an array of uint32
 */
 NTSTATUS ndr_pull_array_uint32(struct ndr_pull *ndr, uint32 *data, uint32 n)
 {
-	uint32 len, i;
+	uint32 len;
 	NDR_CHECK(ndr_pull_uint32(ndr, &len));
 	if (len != n) {
 		return NT_STATUS_INVALID_PARAMETER;
 	}	
-	for (i=0;i<n;i++) {
-		NDR_CHECK(ndr_pull_uint32(ndr, &data[i]));
-	}
-	return NT_STATUS_OK;
+	return ndr_pull_const_array_uint32(ndr, data, n);
 }
 
 
diff --git a/source4/librpc/ndr/ndr_lsa.c b/source4/librpc/ndr/ndr_lsa.c
index 4a7ee4e5ca..e62107a3e8 100644
--- a/source4/librpc/ndr/ndr_lsa.c
+++ b/source4/librpc/ndr/ndr_lsa.c
@@ -1498,6 +1498,7 @@ buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 		NDR_ALLOC_N_SIZE(ndr, r->set, r->count, sizeof(r->set[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->set, sizeof(r->set[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_LUIDAttribute));
+		NDR_CHECK(ndr_pull_const_array_uint32(ndr, r->unknown, 1));
 done:
 	return NT_STATUS_OK;
 }
@@ -1511,6 +1512,10 @@ void ndr_print_lsa_PrivilegeSet(struct ndr_print *ndr, const char *name, struct
 	ndr->depth++;
 		ndr_print_array(ndr, "set", r->set, sizeof(r->set[0]), r->count, (ndr_print_fn_t)ndr_print_lsa_LUIDAttribute);
 	ndr->depth--;
+	ndr_print_ptr(ndr, "unknown", r->unknown);
+	ndr->depth++;
+		ndr_print_array_uint32(ndr, "unknown", r->unknown, 1);
+	ndr->depth--;
 	ndr->depth--;
 }
 
@@ -1533,7 +1538,6 @@ NTSTATUS ndr_pull_lsa_EnumPrivsAccount(struct ndr_pull *ndr, struct lsa_EnumPriv
 	if (r->out.privs) {
 		NDR_CHECK(ndr_pull_lsa_PrivilegeSet(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.privs));
 	}
-	NDR_CHECK(ndr_pull_uint32(ndr, &r->out.unknown));
 	NDR_CHECK(ndr_pull_NTSTATUS(ndr, &r->out.result));
 
 	return NT_STATUS_OK;
diff --git a/source4/librpc/ndr/ndr_lsa.h b/source4/librpc/ndr/ndr_lsa.h
index bf642872e2..b502064bbf 100644
--- a/source4/librpc/ndr/ndr_lsa.h
+++ b/source4/librpc/ndr/ndr_lsa.h
@@ -406,6 +406,7 @@ struct lsa_LUIDAttribute {
 struct lsa_PrivilegeSet {
 	uint32 count;
 	struct lsa_LUIDAttribute *set;
+	uint32 unknown[1];
 };
 
 struct lsa_EnumPrivsAccount {
@@ -415,7 +416,6 @@ struct lsa_EnumPrivsAccount {
 
 	struct {
 		struct lsa_PrivilegeSet *privs;
-		uint32 unknown;
 		NTSTATUS result;
 	} out;