More insure found memory leak and corruption fixes.

Jeremy.
(This used to be commit 3cdcfa6325b9cd2d7f7c90c4b2d1c6ec73fc2f6d)

2 files changed, 60 insertions, 3 deletions

diff --git a/source3/rpc_parse/parse_misc.c b/source3/rpc_parse/parse_misc.c
index da2aa4450e..fe2778a356 100644
--- a/source3/rpc_parse/parse_misc.c
+++ b/source3/rpc_parse/parse_misc.c
@@ -618,6 +618,15 @@ BOOL smb_io_buffer5(char *desc, BUFFER5 *buf5, prs_struct *ps, int depth)
 }
 
 /*******************************************************************
+ Frees a BUFFER5 structure (just the malloced part).
+********************************************************************/
+
+void free_buffer5(BUFFER5 *buf5)
+{
+	safe_free(buf5->buffer);
+}
+
+/*******************************************************************
  Inits a BUFFER2 structure.
 ********************************************************************/
 
diff --git a/source3/rpc_parse/parse_spoolss.c b/source3/rpc_parse/parse_spoolss.c
index 2565439a21..5ed7ce2460 100644
--- a/source3/rpc_parse/parse_spoolss.c
+++ b/source3/rpc_parse/parse_spoolss.c
@@ -3691,11 +3691,22 @@ BOOL spool_io_printer_driver_info_level_3(char *desc, SPOOL_PRINTER_DRIVER_INFO_
 		return False;
 		
 	if (il->dependentfiles_ptr)
-		smb_io_buffer5("", &(il->dependentfiles), ps, depth);
+		smb_io_buffer5("", &il->dependentfiles, ps, depth);
 
 	return True;
 }
 
+void free_spool_printer_driver_info_level_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u)
+{
+	SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *il = *q_u;
+
+	if (il == NULL)
+		return;
+
+	free_buffer5(&il->dependentfiles);
+
+	safe_free(q_u);
+}
 
 /*******************************************************************
 parse a SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 structure
@@ -3836,6 +3847,19 @@ BOOL spool_io_printer_driver_info_level_6(char *desc, SPOOL_PRINTER_DRIVER_INFO_
 	return True;
 }
 
+void free_spool_printer_driver_info_level_6(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u)
+{
+	SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 *il = *q_u;
+
+	if (il == NULL)
+		return;
+
+	free_buffer5(&il->dependentfiles);
+	free_buffer5(&il->previousnames);
+
+	safe_free(q_u);
+}
+
 
 /*******************************************************************
  convert a buffer of UNICODE strings null terminated
@@ -3908,11 +3932,11 @@ BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LE
 		
 	switch (il->level) {
 		case 3:
-			if(!spool_io_printer_driver_info_level_3("", &(il->info_3), ps, depth))
+			if(!spool_io_printer_driver_info_level_3("", &il->info_3, ps, depth))
 				return False;
 			break;		
 		case 6:
-			if(!spool_io_printer_driver_info_level_6("", &(il->info_6), ps, depth))
+			if(!spool_io_printer_driver_info_level_6("", &il->info_6, ps, depth))
 				return False;
 			break;		
 	default:
@@ -3922,6 +3946,21 @@ BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LE
 	return True;
 }
 
+void free_spool_printer_driver_info_level(SPOOL_PRINTER_DRIVER_INFO_LEVEL *il)
+{
+	if (il->ptr==0)
+		return;
+
+	switch (il->level) {
+		case 3:
+			free_spool_printer_driver_info_level_3(&il->info_3);
+			break;
+		case 6:
+			free_spool_printer_driver_info_level_6(&il->info_6);
+			break;
+	}
+}
+
 /*******************************************************************
 ********************************************************************/  
 BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth)
@@ -3949,6 +3988,15 @@ BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, pr
 }
 
 /*******************************************************************
+ Free the dynamic parts of a printer driver.
+********************************************************************/  
+
+void free_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u)
+{
+	free_spool_printer_driver_info_level(&q_u->info);
+}
+
+/*******************************************************************
 ********************************************************************/  
 BOOL spoolss_io_r_addprinterdriver(char *desc, SPOOL_R_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth)
 {