More insure found memory leak and corruption fixes.

Jeremy.
(This used to be commit 3cdcfa6325b9cd2d7f7c90c4b2d1c6ec73fc2f6d)

6 files changed, 89 insertions, 11 deletions

diff --git a/source3/include/proto.h b/source3/include/proto.h
index e1b444545b..050de09c65 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1275,8 +1275,6 @@ char *lp_domain_admin_group(void);
 char *lp_domain_guest_group(void);
 char *lp_domain_admin_users(void);
 char *lp_domain_guest_users(void);
-char *lp_nt_forms(void);
-char *lp_nt_drivers_file(void);
 char *lp_winbind_uid(void);
 char *lp_winbind_gid(void);
 char *lp_template_homedir(void);
@@ -1943,6 +1941,7 @@ void init_buffer3_hex(BUFFER3 *str, char *buf);
 void init_buffer3_bytes(BUFFER3 *str, uint8 *buf, int len);
 BOOL smb_io_buffer3(char *desc, BUFFER3 *buf3, prs_struct *ps, int depth);
 BOOL smb_io_buffer5(char *desc, BUFFER5 *buf5, prs_struct *ps, int depth);
+void free_buffer5(BUFFER5 *buf5);
 void init_buffer2(BUFFER2 *str, uint8 *buf, int len);
 BOOL smb_io_buffer2(char *desc, BUFFER2 *buf2, uint32 buffer, prs_struct *ps, int depth);
 void init_buf_unistr2(UNISTR2 *str, uint32 *ptr, const char *buf);
@@ -2559,11 +2558,15 @@ BOOL spoolss_io_q_addprinterex(char *desc, SPOOL_Q_ADDPRINTEREX *q_u, prs_struct
 BOOL spoolss_io_r_addprinterex(char *desc, SPOOL_R_ADDPRINTEREX *r_u, prs_struct *ps, int depth);
 BOOL spool_io_printer_driver_info_level_3(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u, 
                                           prs_struct *ps, int depth);
+void free_spool_printer_driver_info_level_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u);
 BOOL spool_io_printer_driver_info_level_6(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u, 
                                           prs_struct *ps, int depth);
+void free_spool_printer_driver_info_level_6(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u);
 BOOL smb_io_unibuffer(char *desc, UNISTR2 *buffer, prs_struct *ps, int depth);
 BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL *il, prs_struct *ps, int depth);
+void free_spool_printer_driver_info_level(SPOOL_PRINTER_DRIVER_INFO_LEVEL *il);
 BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth);
+void free_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u);
 BOOL spoolss_io_r_addprinterdriver(char *desc, SPOOL_R_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth);
 BOOL uni_2_asc_printer_driver_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *uni,
                                 NT_PRINTER_DRIVER_INFO_LEVEL_3 **asc);
diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index de3b9ed6c5..82facbe453 100644
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -1276,18 +1276,35 @@ uint32 get_a_printer_driver(NT_PRINTER_DRIVER_INFO_LEVEL *driver, uint32 level,
 uint32 free_a_printer_driver(NT_PRINTER_DRIVER_INFO_LEVEL driver, uint32 level)
 {
 	uint32 success;
-	NT_PRINTER_DRIVER_INFO_LEVEL_3 *info3;
 	
 	switch (level)
 	{
 		case 3: 
 		{
+			NT_PRINTER_DRIVER_INFO_LEVEL_3 *info3;
 			if (driver.info_3 != NULL)
 			{
 				info3=driver.info_3;
 				safe_free(info3->dependentfiles);
-				safe_free(info3);
 				ZERO_STRUCTP(info3);
+				safe_free(info3);
+				success=0;
+			}
+			else
+			{
+				success=4;
+			}
+			break;
+		}
+		case 6: 
+		{
+			NT_PRINTER_DRIVER_INFO_LEVEL_3 *info6;
+			if (driver.info_6 != NULL)
+			{
+				info6=driver.info_6;
+				safe_free(info6->dependentfiles);
+				ZERO_STRUCTP(info6);
+				safe_free(info6);
 				success=0;
 			}
 			else
diff --git a/source3/rpc_parse/parse_misc.c b/source3/rpc_parse/parse_misc.c
index da2aa4450e..fe2778a356 100644
--- a/source3/rpc_parse/parse_misc.c
+++ b/source3/rpc_parse/parse_misc.c
@@ -618,6 +618,15 @@ BOOL smb_io_buffer5(char *desc, BUFFER5 *buf5, prs_struct *ps, int depth)
 }
 
 /*******************************************************************
+ Frees a BUFFER5 structure (just the malloced part).
+********************************************************************/
+
+void free_buffer5(BUFFER5 *buf5)
+{
+	safe_free(buf5->buffer);
+}
+
+/*******************************************************************
  Inits a BUFFER2 structure.
 ********************************************************************/
 
diff --git a/source3/rpc_parse/parse_spoolss.c b/source3/rpc_parse/parse_spoolss.c
index 2565439a21..5ed7ce2460 100644
--- a/source3/rpc_parse/parse_spoolss.c
+++ b/source3/rpc_parse/parse_spoolss.c
@@ -3691,11 +3691,22 @@ BOOL spool_io_printer_driver_info_level_3(char *desc, SPOOL_PRINTER_DRIVER_INFO_
 		return False;
 		
 	if (il->dependentfiles_ptr)
-		smb_io_buffer5("", &(il->dependentfiles), ps, depth);
+		smb_io_buffer5("", &il->dependentfiles, ps, depth);
 
 	return True;
 }
 
+void free_spool_printer_driver_info_level_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u)
+{
+	SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *il = *q_u;
+
+	if (il == NULL)
+		return;
+
+	free_buffer5(&il->dependentfiles);
+
+	safe_free(q_u);
+}
 
 /*******************************************************************
 parse a SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 structure
@@ -3836,6 +3847,19 @@ BOOL spool_io_printer_driver_info_level_6(char *desc, SPOOL_PRINTER_DRIVER_INFO_
 	return True;
 }
 
+void free_spool_printer_driver_info_level_6(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u)
+{
+	SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 *il = *q_u;
+
+	if (il == NULL)
+		return;
+
+	free_buffer5(&il->dependentfiles);
+	free_buffer5(&il->previousnames);
+
+	safe_free(q_u);
+}
+
 
 /*******************************************************************
  convert a buffer of UNICODE strings null terminated
@@ -3908,11 +3932,11 @@ BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LE
 		
 	switch (il->level) {
 		case 3:
-			if(!spool_io_printer_driver_info_level_3("", &(il->info_3), ps, depth))
+			if(!spool_io_printer_driver_info_level_3("", &il->info_3, ps, depth))
 				return False;
 			break;		
 		case 6:
-			if(!spool_io_printer_driver_info_level_6("", &(il->info_6), ps, depth))
+			if(!spool_io_printer_driver_info_level_6("", &il->info_6, ps, depth))
 				return False;
 			break;		
 	default:
@@ -3922,6 +3946,21 @@ BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LE
 	return True;
 }
 
+void free_spool_printer_driver_info_level(SPOOL_PRINTER_DRIVER_INFO_LEVEL *il)
+{
+	if (il->ptr==0)
+		return;
+
+	switch (il->level) {
+		case 3:
+			free_spool_printer_driver_info_level_3(&il->info_3);
+			break;
+		case 6:
+			free_spool_printer_driver_info_level_6(&il->info_6);
+			break;
+	}
+}
+
 /*******************************************************************
 ********************************************************************/  
 BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth)
@@ -3949,6 +3988,15 @@ BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, pr
 }
 
 /*******************************************************************
+ Free the dynamic parts of a printer driver.
+********************************************************************/  
+
+void free_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u)
+{
+	free_spool_printer_driver_info_level(&q_u->info);
+}
+
+/*******************************************************************
 ********************************************************************/  
 BOOL spoolss_io_r_addprinterdriver(char *desc, SPOOL_R_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth)
 {
diff --git a/source3/rpc_server/srv_spoolss.c b/source3/rpc_server/srv_spoolss.c
index 74901efa78..2513fe91e6 100755
--- a/source3/rpc_server/srv_spoolss.c
+++ b/source3/rpc_server/srv_spoolss.c
@@ -833,9 +833,12 @@ static BOOL api_spoolss_addprinterdriver(prs_struct *data, prs_struct *rdata)
 				
 	if(!spoolss_io_r_addprinterdriver("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_addprinterdriver: unable to marshall SPOOL_R_ADDPRINTERDRIVER.\n"));
+		free_spoolss_q_addprinterdriver(&q_u);
 		return False;
 	}
 	
+	free_spoolss_q_addprinterdriver(&q_u);
+
 	return True;
 }
 
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index f181585c84..b77deca158 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -3917,14 +3917,12 @@ uint32 _spoolss_addprinterdriver( const UNISTR2 *server_name,
 
 #ifdef RELIES_ON_SMBD_FUNCTIONS_LINKED_INTO_SPOOLSSD
 	if ((err = modify_driver_heirarchy(&driver, level)) != 0) {
-		safe_free(driver.info_3);
-		safe_free(driver.info_6);
+		free_a_printer_driver(driver, level);
 		return err;
 	}
 #endif
 
-	safe_free(driver.info_3);
-	safe_free(driver.info_6);
+	free_a_printer_driver(driver, level);
 
 	return NT_STATUS_NO_PROBLEMO;
 }