Added limit on SPOOLSS pipes from 2.2.x

Jeremy.
(This used to be commit b35fc30c37fa894acea3fcb7b48ee9841d1bd5e8)

1 files changed, 31 insertions, 8 deletions

diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c
index c55e05fe8d..d4d45c230c 100644
--- a/source3/rpc_server/srv_pipe_hnd.c
+++ b/source3/rpc_server/srv_pipe_hnd.c
@@ -35,6 +35,23 @@ static int pipes_open;
 #define MAX_OPEN_PIPES 2048
 #endif
 
+/*
+ * Sometimes I can't decide if I hate Windows printer driver
+ * writers more than I hate the Windows spooler service driver
+ * writers. This gets around a combination of bugs in the spooler
+ * and the HP 8500 PCL driver that causes a spooler spin. JRA.
+ *
+ * bumped up from 20 -> 64 after viewing traffic from WordPerfect
+ * 2002 running on NT 4.- SP6
+ * bumped up from 64 -> 256 after viewing traffic from con2prt
+ * for lots of printers on a WinNT 4.x SP6 box.
+ */
+ 
+#ifndef MAX_OPEN_SPOOLSS_PIPES
+#define MAX_OPEN_SPOOLSS_PIPES 256
+#endif
+static int current_spoolss_pipes_open;
+
 static smb_np_struct *Pipes;
 static pipes_struct *InternalPipes;
 static struct bitmap *bmap;
@@ -102,6 +119,7 @@ void set_pipe_handle_offset(int max_open_files)
 /****************************************************************************
  Reset pipe chain handle number.
 ****************************************************************************/
+
 void reset_chain_p(void)
 {
 	chain_p = NULL;
@@ -158,11 +176,20 @@ smb_np_struct *open_rpc_pipe_p(char *pipe_name,
 	int i;
 	smb_np_struct *p, *p_it;
 	static int next_pipe;
+	BOOL is_spoolss_pipe = False;
 
 	DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
 		 pipe_name, pipes_open));
 
-	
+	if (strstr(pipe_name, "spoolss"))
+		is_spoolss_pipe = True;
+ 
+	if (is_spoolss_pipe && current_spoolss_pipes_open >= MAX_OPEN_SPOOLSS_PIPES) {
+		DEBUG(10,("open_rpc_pipe_p: spooler bug workaround. Denying open on pipe %s\n",
+			pipe_name ));
+		return NULL;
+	}
+
 	/* not repeating pipe numbers makes it easier to track things in 
 	   log files and prevents client bugs where pipe numbers are reused
 	   over connection restarts */
@@ -183,8 +210,7 @@ smb_np_struct *open_rpc_pipe_p(char *pipe_name,
 
 	p = (smb_np_struct *)malloc(sizeof(*p));
 
-	if (!p)
-	{
+	if (!p) {
 		DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
 		return NULL;
 	}
@@ -201,13 +227,11 @@ smb_np_struct *open_rpc_pipe_p(char *pipe_name,
 	p->np_state = p->namedpipe_create(pipe_name, conn, vuid);
 
 	if (p->np_state == NULL) {
-
 		DEBUG(0,("open_rpc_pipe_p: make_internal_rpc_pipe_p failed.\n"));
 		SAFE_FREE(p);
 		return NULL;
 	}
 
-
 	DLIST_ADD(Pipes, p);
 
 	/*
@@ -247,7 +271,7 @@ smb_np_struct *open_rpc_pipe_p(char *pipe_name,
 }
 
 /****************************************************************************
- * make an internal namedpipes structure
+ Make an internal namedpipes structure
 ****************************************************************************/
 
 static void *make_internal_rpc_pipe_p(char *pipe_name, 
@@ -321,9 +345,8 @@ static void *make_internal_rpc_pipe_p(char *pipe_name,
 	p->pipe_user.gid = (gid_t)-1;
 	
 	/* Store the session key */
-	if (vuser) {
+	if (vuser)
 		memcpy(p->session_key, vuser->session_key, sizeof(p->session_key));
-	}
 
 	/*
 	 * Initialize the incoming RPC struct.