don't leak printer handles,

don't coredump when adding forms,
and a small non obvious memory leak in the rpc buffers

	J.F.
(This used to be commit bee11f8889378b9f1cc6e2818fd0f8dd7ddcf10d)

4 files changed, 23 insertions, 9 deletions

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 8b18a0487b..f391f19879 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1636,7 +1636,7 @@ struct passgrp_ops *unix_initialise_password_grp(void);
 
 int get_ntforms(nt_forms_struct **list);
 int write_ntforms(nt_forms_struct **list, int number);
-void add_a_form(nt_forms_struct **list, FORM form, int count);
+void add_a_form(nt_forms_struct **list, FORM form, int *count);
 void update_a_form(nt_forms_struct **list, FORM form, int count);
 int get_ntdrivers(connection_struct *conn, fstring **list, char *architecture);
 void get_short_archi(char *short_archi, char *long_archi);
diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index a384b8e31a..90a53f1f7c 100644
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -126,7 +126,7 @@ int write_ntforms(nt_forms_struct **list, int number)
 /****************************************************************************
 add a form struct at the end of the list
 ****************************************************************************/
-void add_a_form(nt_forms_struct **list, FORM form, int count)
+void add_a_form(nt_forms_struct **list, FORM form, int *count)
 {
 	int n=0;
 	BOOL update;
@@ -141,7 +141,7 @@ void add_a_form(nt_forms_struct **list, FORM form, int count)
 	update=False;
 	
 	unistr2_to_ascii(form_name, &(form.name), sizeof(form_name)-1);
-	for (n=0; n<count && update==False; n++)
+	for (n=0; n<*count && update==False; n++)
 	{
 		if (!strncmp((*list)[n].name, form_name, strlen(form_name)))
 		{
@@ -154,6 +154,7 @@ void add_a_form(nt_forms_struct **list, FORM form, int count)
 	{
 		*list=Realloc(*list, (n+1)*sizeof(nt_forms_struct));
 		unistr2_to_ascii((*list)[n].name, &(form.name), sizeof((*list)[n].name)-1);
+		(*count)++;
 	}
 	
 	(*list)[n].flag=form.flags;
@@ -163,7 +164,6 @@ void add_a_form(nt_forms_struct **list, FORM form, int count)
 	(*list)[n].top=form.top;
 	(*list)[n].right=form.right;
 	(*list)[n].bottom=form.bottom;
-
 }
 
 /****************************************************************************
diff --git a/source3/rpc_server/srv_spoolss.c b/source3/rpc_server/srv_spoolss.c
index 736ed07dca..166ac5a452 100755
--- a/source3/rpc_server/srv_spoolss.c
+++ b/source3/rpc_server/srv_spoolss.c
@@ -407,7 +407,19 @@ static void spoolss_reply_open_printer(SPOOL_Q_OPEN_PRINTER *q_u, prs_struct *rd
 	}
 	
 	set_printer_hnd_accesstype(&(r_u.handle), q_u->access_required);
+
+
+	/* if there is a error free the printer entry */
 	
+	if (r_u.status != 0x00000000)
+	{
+		int pnum;
+
+		pnum = find_printer_index_by_hnd(&(r_u.handle));
+		Printer[pnum].open=False;
+		clear_handle(&(r_u.handle));
+	}	
+
 	spoolss_io_r_open_printer("",&r_u,rdata,0);
 }
 
@@ -669,7 +681,6 @@ static void spoolss_reply_closeprinter(SPOOL_Q_CLOSEPRINTER *q_u, prs_struct *rd
 	{
 		Printer[pnum].open=False;
 		r_u.status=0x0;	
-		spoolss_io_r_closeprinter("",&r_u,rdata,0);
 	}
 	else
 	{
@@ -3551,9 +3562,9 @@ static void spoolss_reply_addform(SPOOL_Q_ADDFORM *q_u, prs_struct *rdata)
        {
 	       count=get_ntforms(&list);
 
-	       add_a_form(&list, q_u->form, count);
+	       add_a_form(&list, q_u->form, &count);
 
-	       write_ntforms(&list, count+1);
+	       write_ntforms(&list, count);
 
 	       free(list);
        }
diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c
index 5a0bf6ac07..10c859d266 100644
--- a/source3/smbd/ipc.c
+++ b/source3/smbd/ipc.c
@@ -3128,7 +3128,10 @@ static void api_rpc_trans_reply(char *outbuf,
 		/* all of data was sent: no need to wait for SMBreadX calls */
 		mem_free_data(p->rhdr .data);
 		mem_free_data(p->rdata.data);
- 		mem_free_data(p->rdata_i.data);
+ 		mem_free_data(p->rdata_i.data);		
+		mem_free_data(p->rauth.data);
+		mem_free_data(p->rverf.data);
+ 		mem_free_data(p->rntlm.data);		
 	}
 }
 
@@ -3281,7 +3284,7 @@ static int api_fd_reply(connection_struct *conn,uint16 vuid,char *outbuf,
 	}
 
  	mem_free_data(pd.data);
-
+	
 	if (!reply)
 	{
 		return api_no_reply(outbuf, mdrcnt);