Move to talloc control of SPOOL_XXX structs. Move to talloc control of

security descriptors and pointers. Syncup with 2.2 tree.
Jeremy.
(This used to be commit 14d5997dc841e78a619e865288486d50c245896d)

2 files changed, 27 insertions, 145 deletions

diff --git a/source3/rpc_server/srv_spoolss.c b/source3/rpc_server/srv_spoolss.c
index 8c06f16290..cd490d1944 100755
--- a/source3/rpc_server/srv_spoolss.c
+++ b/source3/rpc_server/srv_spoolss.c
@@ -53,9 +53,6 @@ static BOOL api_spoolss_open_printer_ex(pipes_struct *p)
 	                                       q_u.user_switch, q_u.user_ctr,
 	                                       &r_u.handle);
 
-	/* we _really_ need to switch to talloc() */
-	free_spoolss_q_open_printer_ex(&q_u);
-
 	if (!spoolss_io_r_open_printer_ex("",&r_u,rdata,0)){
 		DEBUG(0,("spoolss_io_r_open_printer_ex: unable to marshall SPOOL_R_OPEN_PRINTER_EX.\n"));
 		return False;
@@ -85,7 +82,7 @@ static BOOL api_spoolss_getprinterdata(pipes_struct *p)
 		return False;
 	}
 	
-	r_u.status = _spoolss_getprinterdata( &q_u.handle, &q_u.valuename,
+	r_u.status = _spoolss_getprinterdata( p, &q_u.handle, &q_u.valuename,
 	                                      q_u.size, &r_u.type, &r_u.size,
 	                                      &r_u.data, &r_u.needed);
 
@@ -94,8 +91,6 @@ static BOOL api_spoolss_getprinterdata(pipes_struct *p)
 		return False;
 	}
 
-	safe_free(r_u.data);
-
 	return True;
 }
 
@@ -277,9 +272,7 @@ static BOOL api_spoolss_rfnpcnex(pipes_struct *p)
 	}
 
 	r_u.status = _spoolss_rfnpcnex(&q_u.handle, q_u.change,
-	                               q_u.option, data->mem_ctx, &r_u.info);
-
-	safe_free(q_u.option);
+	                               q_u.option, p->mem_ctx, &r_u.info);
 
 	/* we always have a NOTIFY_INFO struct */
 	r_u.info_ptr=0x1;
@@ -289,8 +282,6 @@ static BOOL api_spoolss_rfnpcnex(pipes_struct *p)
 		return False;
 	}
 
-	safe_free(r_u.info.data);
-
 	return True;
 }
 
@@ -310,9 +301,6 @@ static BOOL api_spoolss_enumprinters(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumprinters("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprinters: unable to unmarshall SPOOL_Q_ENUMPRINTERS.\n"));
 		return False;
@@ -327,12 +315,9 @@ static BOOL api_spoolss_enumprinters(pipes_struct *p)
 
 	if (!new_spoolss_io_r_enumprinters("", &r_u, rdata, 0)) {
 		DEBUG(0,("new_spoolss_io_r_enumprinters: unable to marshall SPOOL_R_ENUMPRINTERS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -351,9 +336,6 @@ static BOOL api_spoolss_getprinter(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_getprinter("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getprinter: unable to unmarshall SPOOL_Q_GETPRINTER.\n"));
 		return False;
@@ -368,11 +350,9 @@ static BOOL api_spoolss_getprinter(pipes_struct *p)
 
 	if(!spoolss_io_r_getprinter("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_getprinter: unable to marshall SPOOL_R_GETPRINTER.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
 	return True;
 }
 
@@ -392,9 +372,6 @@ static BOOL api_spoolss_getprinterdriver2(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_getprinterdriver2("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getprinterdriver2: unable to unmarshall SPOOL_Q_GETPRINTERDRIVER2.\n"));
 		return False;
@@ -410,11 +387,9 @@ static BOOL api_spoolss_getprinterdriver2(pipes_struct *p)
 	
 	if(!spoolss_io_r_getprinterdriver2("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_getprinterdriver2: unable to marshall SPOOL_R_GETPRINTERDRIVER2.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 	
-	new_spoolss_free_buffer(q_u.buffer);
 	return True;
 }
 
@@ -560,7 +535,6 @@ static BOOL api_spoolss_writeprinter(pipes_struct *p)
 	                                   q_u.buffer,
 	                                   &q_u.buffer_size2);
 	r_u.buffer_written = q_u.buffer_size2;
-	safe_free(q_u.buffer);
 
 	if(!spoolss_io_r_writeprinter("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_writeprinter: unable to marshall SPOOL_R_WRITEPRINTER.\n"));
@@ -594,13 +568,9 @@ static BOOL api_spoolss_setprinter(pipes_struct *p)
 	
 	if(!spoolss_io_r_setprinter("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_setprinter: unable to marshall SPOOL_R_SETPRINTER.\n"));
-		free_spoolss_q_setprinter(&q_u);
 		return False;
 	}
 
-	/* Free anything allocated in the unparse. */
-	free_spoolss_q_setprinter(&q_u);
-
 	return True;
 }
 
@@ -644,9 +614,6 @@ static BOOL api_spoolss_addjob(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_addjob("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_addjob: unable to unmarshall SPOOL_Q_ADDJOB.\n"));
 		return False;
@@ -660,12 +627,9 @@ static BOOL api_spoolss_addjob(pipes_struct *p)
 		
 	if(!spoolss_io_r_addjob("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_addjob: unable to marshall SPOOL_R_ADDJOB.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;		
 }
 
@@ -682,9 +646,6 @@ static BOOL api_spoolss_enumjobs(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumjobs("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumjobs: unable to unmarshall SPOOL_Q_ENUMJOBS.\n"));
 		return False;
@@ -699,12 +660,9 @@ static BOOL api_spoolss_enumjobs(pipes_struct *p)
 
 	if (!spoolss_io_r_enumjobs("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_enumjobs: unable to marshall SPOOL_R_ENUMJOBS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -777,9 +735,6 @@ static BOOL api_spoolss_enumprinterdrivers(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumprinterdrivers("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprinterdrivers: unable to unmarshall SPOOL_Q_ENUMPRINTERDRIVERS.\n"));
 		return False;
@@ -794,12 +749,9 @@ static BOOL api_spoolss_enumprinterdrivers(pipes_struct *p)
 
 	if (!new_spoolss_io_r_enumprinterdrivers("",&r_u,rdata,0)) {
 		DEBUG(0,("new_spoolss_io_r_enumprinterdrivers: unable to marshall SPOOL_R_ENUMPRINTERDRIVERS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -816,9 +768,6 @@ static BOOL api_spoolss_getform(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_getform("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getform: unable to unmarshall SPOOL_Q_GETFORM.\n"));
 		return False;
@@ -832,12 +781,9 @@ static BOOL api_spoolss_getform(pipes_struct *p)
 
 	if (!new_spoolss_io_r_getform("",&r_u,rdata,0)) {
 		DEBUG(0,("new_spoolss_io_r_getform: unable to marshall SPOOL_R_GETFORM.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -853,9 +799,6 @@ static BOOL api_spoolss_enumforms(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumforms("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumforms: unable to unmarshall SPOOL_Q_ENUMFORMS.\n"));
 		return False;
@@ -870,12 +813,9 @@ static BOOL api_spoolss_enumforms(pipes_struct *p)
 
 	if (!new_spoolss_io_r_enumforms("",&r_u,rdata,0)) {
 		DEBUG(0,("new_spoolss_io_r_enumforms: unable to marshall SPOOL_R_ENUMFORMS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -892,9 +832,6 @@ static BOOL api_spoolss_enumports(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_enumports("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumports: unable to unmarshall SPOOL_Q_ENUMPORTS.\n"));
 		return False;
@@ -909,12 +846,9 @@ static BOOL api_spoolss_enumports(pipes_struct *p)
 
 	if (!new_spoolss_io_r_enumports("",&r_u,rdata,0)) {
 		DEBUG(0,("new_spoolss_io_r_enumports: unable to marshall SPOOL_R_ENUMPORTS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -947,17 +881,6 @@ static BOOL api_spoolss_addprinterex(pipes_struct *p)
 		return False;
 	}
 	
-	if (q_u.info.info_ptr!=0) {
-		switch (q_u.info.level) {
-			case 1:
-				safe_free(q_u.info.info_1);
-				break;
-			case 2:
-				safe_free(q_u.info.info_2);
-				break;
-		}
-	}
-		
 	return True;
 }
 
@@ -975,7 +898,6 @@ static BOOL api_spoolss_addprinterdriver(pipes_struct *p)
 	
 	if(!spoolss_io_q_addprinterdriver("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_addprinterdriver: unable to unmarshall SPOOL_Q_ADDPRINTERDRIVER.\n"));
-		free_spoolss_q_addprinterdriver(&q_u);
 		return False;
 	}
 	
@@ -983,12 +905,9 @@ static BOOL api_spoolss_addprinterdriver(pipes_struct *p)
 				
 	if(!spoolss_io_r_addprinterdriver("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_addprinterdriver: unable to marshall SPOOL_R_ADDPRINTERDRIVER.\n"));
-		free_spoolss_q_addprinterdriver(&q_u);
 		return False;
 	}
 	
-	free_spoolss_q_addprinterdriver(&q_u);
-
 	return True;
 }
 
@@ -1004,9 +923,6 @@ static BOOL api_spoolss_getprinterdriverdirectory(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_getprinterdriverdir("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getprinterdriverdir: unable to unmarshall SPOOL_Q_GETPRINTERDRIVERDIR.\n"));
 		return False;
@@ -1021,12 +937,9 @@ static BOOL api_spoolss_getprinterdriverdirectory(pipes_struct *p)
 
 	if(!spoolss_io_r_getprinterdriverdir("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_getprinterdriverdir: unable to marshall SPOOL_R_GETPRINTERDRIVERDIR.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -1047,21 +960,16 @@ static BOOL api_spoolss_enumprinterdata(pipes_struct *p)
 		return False;
 	}
 	
-	r_u.status = _spoolss_enumprinterdata(&q_u.handle, q_u.index, q_u.valuesize, q_u.datasize,
+	r_u.status = _spoolss_enumprinterdata(p, &q_u.handle, q_u.index, q_u.valuesize, q_u.datasize,
 						&r_u.valuesize, &r_u.value, &r_u.realvaluesize,
 						&r_u.type,
 						&r_u.datasize, &r_u.data, &r_u.realdatasize);
 				
 	if(!spoolss_io_r_enumprinterdata("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_enumprinterdata: unable to marshall SPOOL_R_ENUMPRINTERDATA.\n"));
-		safe_free(r_u.value);
-		safe_free(r_u.data);
 		return False;
 	}
 
-	safe_free(r_u.value);
-	safe_free(r_u.data);
-
 	return True;
 }
 
@@ -1086,8 +994,6 @@ static BOOL api_spoolss_setprinterdata(pipes_struct *p)
 				&q_u.value, q_u.type, q_u.max_len,
 				q_u.data, q_u.real_len, q_u.numeric_data);
 				
-	free_spoolss_q_setprinterdata(&q_u);
-
 	if(!spoolss_io_r_setprinterdata("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_setprinterdata: unable to marshall SPOOL_R_SETPRINTERDATA.\n"));
 		return False;
@@ -1189,9 +1095,6 @@ static BOOL api_spoolss_enumprintprocessors(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 	
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_enumprintprocessors("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprintprocessors: unable to unmarshall SPOOL_Q_ENUMPRINTPROCESSORS.\n"));
 		return False;
@@ -1206,12 +1109,9 @@ static BOOL api_spoolss_enumprintprocessors(pipes_struct *p)
 
 	if(!spoolss_io_r_enumprintprocessors("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_enumprintprocessors: unable to marshall SPOOL_R_ENUMPRINTPROCESSORS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 	
-	new_spoolss_free_buffer(q_u.buffer);
-	
 	return True;
 }
 
@@ -1227,9 +1127,6 @@ static BOOL api_spoolss_enumprintprocdatatypes(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 	
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_enumprintprocdatatypes("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprintprocdatatypes: unable to unmarshall SPOOL_Q_ENUMPRINTPROCDATATYPES.\n"));
 		return False;
@@ -1244,12 +1141,9 @@ static BOOL api_spoolss_enumprintprocdatatypes(pipes_struct *p)
 
 	if(!spoolss_io_r_enumprintprocdatatypes("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_enumprintprocdatatypes: unable to marshall SPOOL_R_ENUMPRINTPROCDATATYPES.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 	
-	new_spoolss_free_buffer(q_u.buffer);
-	
 	return True;
 }
 
@@ -1265,9 +1159,6 @@ static BOOL api_spoolss_enumprintmonitors(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 	
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumprintmonitors("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprintmonitors: unable to unmarshall SPOOL_Q_ENUMPRINTMONITORS.\n"));
 		return False;
@@ -1282,12 +1173,9 @@ static BOOL api_spoolss_enumprintmonitors(pipes_struct *p)
 
 	if (!spoolss_io_r_enumprintmonitors("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_enumprintmonitors: unable to marshall SPOOL_R_ENUMPRINTMONITORS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 	
-	new_spoolss_free_buffer(q_u.buffer);
-	
 	return True;
 }
 
@@ -1300,9 +1188,6 @@ static BOOL api_spoolss_getjob(pipes_struct *p)
 	prs_struct *data = &p->in_data.data;
 	prs_struct *rdata = &p->out_data.rdata;
 	
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_getjob("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getjob: unable to unmarshall SPOOL_Q_GETJOB.\n"));
 		return False;
@@ -1317,11 +1202,9 @@ static BOOL api_spoolss_getjob(pipes_struct *p)
 	
 	if(!spoolss_io_r_getjob("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_getjob: unable to marshall SPOOL_R_GETJOB.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 		
-	new_spoolss_free_buffer(q_u.buffer);
 	return True;
 }
 
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index d5f0703e03..4612384b0d 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -1155,7 +1155,7 @@ static BOOL getprinterdata_printer(POLICY_HND *handle,
 /********************************************************************
  * spoolss_getprinterdata
  ********************************************************************/
-uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
+uint32 _spoolss_getprinterdata(pipes_struct *p, POLICY_HND *handle, UNISTR2 *valuename,
 				uint32 in_size,
 				uint32 *type,
 				uint32 *out_size,
@@ -1199,9 +1199,8 @@ uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
 		DEBUG(5, ("value not found, allocating %d\n", *out_size));
 		/* reply this param doesn't exist */
 		if (*out_size) {
-			if((*data=(uint8 *)malloc(*out_size*sizeof(uint8))) == NULL)
+			if((*data=(uint8 *)talloc_zero(p->mem_ctx, *out_size*sizeof(uint8))) == NULL)
 				return ERROR_NOT_ENOUGH_MEMORY;
-			memset(*data, '\0', *out_size*sizeof(uint8));
 		} else {
 			*data = NULL;
 		}
@@ -2070,7 +2069,9 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int
 	SPOOL_NOTIFY_INFO_DATA *current_data;
 	NT_PRINTER_INFO_LEVEL *printer = NULL;
 	print_queue_struct *queue=NULL;
-	
+	size_t realloc_size = 0;
+	SPOOL_NOTIFY_INFO_DATA *info_data_ptr = NULL;
+
 	type=option_type->type;
 
 	DEBUG(4,("construct_notify_printer_info: Notify type: [%s], number of notify info: [%d] on printer: [%s]\n",
@@ -2087,10 +2088,11 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int
 		if (!search_notify(type, field, &j) )
 			continue;
 		
-		if((info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
+		realloc_size = (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA);
+		if((info_data_ptr=(SPOOL_NOTIFY_INFO_DATA *)Realloc(info_data_ptr, realloc_size)) == NULL) {
 			return False;
 		}
-		current_data=&info->data[info->count];
+		current_data=&info_data_ptr[info->count];
 
 		construct_info_data(current_data, type, field, id);		
 
@@ -2103,6 +2105,12 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int
 		info->count++;
 	}
 
+	if (realloc_size)
+		info->data = talloc_memdup(mem_ctx, info_data_ptr, realloc_size);
+	else
+		info->data = NULL;
+
+	safe_free(info_data_ptr);
 	free_a_printer(&printer, 2);
 	return True;
 }
@@ -2322,9 +2330,8 @@ static uint32 printer_notify_info(POLICY_HND *hnd, SPOOL_NOTIFY_INFO *info,
 /********************************************************************
  * spoolss_rfnpcnex
  ********************************************************************/
-uint32 _spoolss_rfnpcnex( POLICY_HND *handle, uint32 change,
-			  SPOOL_NOTIFY_OPTION *option, TALLOC_CTX *mem_ctx,
-			  SPOOL_NOTIFY_INFO *info)
+uint32 _spoolss_rfnpcnex( pipes_struct *p, POLICY_HND *handle, uint32 change,
+			  SPOOL_NOTIFY_OPTION *option, SPOOL_NOTIFY_INFO *info)
 {
 	Printer_entry *Printer=find_printer_index_by_hnd(handle);
 	uint32 result = ERROR_INVALID_HANDLE;
@@ -2348,18 +2355,16 @@ uint32 _spoolss_rfnpcnex( POLICY_HND *handle, uint32 change,
 	 *	informations even when _NOTHING_ has changed.
 	 */
 
-	/* just discard the SPOOL_NOTIFY_OPTION */
-	if (option!=NULL)
-		safe_free(option->ctr.type);
+	/* just ignore the SPOOL_NOTIFY_OPTION */
 	
 	switch (Printer->printer_type) {
 		case PRINTER_HANDLE_IS_PRINTSERVER:
 			result = printserver_notify_info(handle, info, 
-							 mem_ctx);
+							 p->mem_ctx);
 			break;
 			
 		case PRINTER_HANDLE_IS_PRINTER:
-			result = printer_notify_info(handle, info, mem_ctx);
+			result = printer_notify_info(handle, info, p->mem_ctx);
 			break;
 	}
 	
@@ -2910,7 +2915,6 @@ static BOOL enum_all_printers_info_2(NEW_BUFFER *buffer, uint32 offered, uint32
 	if (!alloc_buffer_size(buffer, *needed)) {
 		for (i=0; i<*returned; i++) {
 			free_devmode(printers[i].devmode);
-			free_sec_desc(&printers[i].secdesc);
 		}
 		safe_free(printers);
 		return ERROR_INSUFFICIENT_BUFFER;
@@ -2923,7 +2927,6 @@ static BOOL enum_all_printers_info_2(NEW_BUFFER *buffer, uint32 offered, uint32
 	/* clear memory */
 	for (i=0; i<*returned; i++) {
 		free_devmode(printers[i].devmode);
-		free_sec_desc(&printers[i].secdesc);
 	}
 	safe_free(printers);
 
@@ -3930,7 +3933,7 @@ static uint32 update_printer_sec(POLICY_HND *handle, uint32 level,
 	   dialog boxes when the user doesn't have permission to change
 	   the security descriptor. */
 
-	nt_printing_getsec(Printer->dev.handlename, &old_secdesc_ctr);
+	nt_printing_getsec(p->mem_ctx, Printer->dev.handlename, &old_secdesc_ctr);
 
 	if (DEBUGLEVEL >= 10) {
 		SEC_ACL *acl;
@@ -3968,7 +3971,7 @@ static uint32 update_printer_sec(POLICY_HND *handle, uint32 level,
 		}
 	}
 
-	new_secdesc_ctr = sec_desc_merge(secdesc_ctr, old_secdesc_ctr);
+	new_secdesc_ctr = sec_desc_merge(p->mem_ctx, secdesc_ctr, old_secdesc_ctr);
 
 	if (sec_desc_equal(new_secdesc_ctr->sec, old_secdesc_ctr->sec)) {
 		result = NT_STATUS_NO_PROBLEMO;
@@ -3992,8 +3995,6 @@ static uint32 update_printer_sec(POLICY_HND *handle, uint32 level,
 	result = nt_printing_setsec(Printer->dev.handlename, new_secdesc_ctr);
 
  done:
-	free_sec_desc_buf(&new_secdesc_ctr);
-	free_sec_desc_buf(&old_secdesc_ctr);
 
 	return result;
 }
@@ -5626,7 +5627,7 @@ uint32 _spoolss_getprinterdriverdirectory(UNISTR2 *name, UNISTR2 *uni_environmen
 	
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_enumprinterdata(POLICY_HND *handle, uint32 idx,
+uint32 _spoolss_enumprinterdata(pipes_struct *p, POLICY_HND *handle, uint32 idx,
 				uint32 in_value_len, uint32 in_data_len,
 				uint32 *out_max_value_len, uint16 **out_value, uint32 *out_value_len,
 				uint32 *out_type,
@@ -5758,24 +5759,22 @@ uint32 _spoolss_enumprinterdata(POLICY_HND *handle, uint32 idx,
 	 */
 	
 	*out_max_value_len=(in_value_len/sizeof(uint16));
-	if((*out_value=(uint16 *)malloc(in_value_len*sizeof(uint8))) == NULL) {
+	if((*out_value=(uint16 *)talloc_zero(p->mem_ctx,in_value_len*sizeof(uint8))) == NULL) {
 		safe_free(data);
 		return ERROR_NOT_ENOUGH_MEMORY;
 	}
 	
-	ZERO_STRUCTP(*out_value);
 	*out_value_len = (uint32)dos_PutUniCode((char *)*out_value, value, in_value_len, True);
 
 	*out_type=type;
 
 	/* the data is counted in bytes */
 	*out_max_data_len=in_data_len;
-	if((*data_out=(uint8 *)malloc(in_data_len*sizeof(uint8))) == NULL) {
+	if((*data_out=(uint8 *)talloc_zero(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL) {
 		safe_free(data);
 		return ERROR_NOT_ENOUGH_MEMORY;
 	}
 	
-	memset(*data_out,'\0',in_data_len);
 	memcpy(*data_out, data, (size_t)data_len);
 	*out_data_len=data_len;