Move to talloc control of SPOOL_XXX structs. Move to talloc control of

security descriptors and pointers. Syncup with 2.2 tree.
Jeremy.
(This used to be commit 14d5997dc841e78a619e865288486d50c245896d)

13 files changed, 451 insertions, 707 deletions

diff --git a/source3/include/proto.h b/source3/include/proto.h
index bcde386362..69b099fe6e 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -369,6 +369,7 @@ void talloc_destroy_pool(TALLOC_CTX *t);
 void talloc_destroy(TALLOC_CTX *t);
 size_t talloc_pool_size(TALLOC_CTX *t);
 void *talloc_zero(TALLOC_CTX *t, size_t size);
+void *talloc_memdup(TALLOC_CTX *t, void *p, size_t size);
 
 /*The following definitions come from  lib/time.c  */
 
@@ -522,7 +523,7 @@ struct cli_connection* RpcHndList_get_connection(const POLICY_HND *hnd);
 void se_map_generic(uint32 *access_mask, struct generic_mapping *mapping);
 BOOL se_access_check(SEC_DESC *sd, struct current_user *user,
 		     uint32 acc_desired, uint32 *acc_granted, uint32 *status);
-SEC_DESC_BUF *se_create_child_secdesc(SEC_DESC *parent_ctr, 
+SEC_DESC_BUF *se_create_child_secdesc(TALLOC_CTX *ctx, SEC_DESC *parent_ctr, 
 				      BOOL child_container);
 
 /*The following definitions come from  lib/util_sec.c  */
@@ -1993,7 +1994,7 @@ BOOL get_specific_param_by_index(NT_PRINTER_INFO_LEVEL printer, uint32 level, ui
 BOOL get_specific_param(NT_PRINTER_INFO_LEVEL printer, uint32 level,
                         fstring value, uint8 **data, uint32 *type, uint32 *len);
 uint32 nt_printing_setsec(char *printername, SEC_DESC_BUF *secdesc_ctr);
-BOOL nt_printing_getsec(char *printername, SEC_DESC_BUF **secdesc_ctr);
+BOOL nt_printing_getsec(TALLOC_CTX *ctx, char *printername, SEC_DESC_BUF **secdesc_ctr);
 void map_printer_permissions(SEC_DESC *sd);
 BOOL print_access_check(struct current_user *user, int snum, int access_type);
 BOOL print_time_access_check(int snum);
@@ -2969,26 +2970,23 @@ void init_sec_access(SEC_ACCESS *t, uint32 mask);
 BOOL sec_io_access(char *desc, SEC_ACCESS *t, prs_struct *ps, int depth);
 void init_sec_ace(SEC_ACE *t, DOM_SID *sid, uint8 type, SEC_ACCESS mask, uint8 flag);
 BOOL sec_io_ace(char *desc, SEC_ACE *psa, prs_struct *ps, int depth);
-SEC_ACL *make_sec_acl(uint16 revision, int num_aces, SEC_ACE *ace_list);
-SEC_ACL *dup_sec_acl( SEC_ACL *src);
-void free_sec_acl(SEC_ACL **ppsa);
+SEC_ACL *make_sec_acl(TALLOC_CTX *ctx, uint16 revision, int num_aces, SEC_ACE *ace_list);
+SEC_ACL *dup_sec_acl(TALLOC_CTX *ctx, SEC_ACL *src);
 BOOL sec_io_acl(char *desc, SEC_ACL **ppsa, prs_struct *ps, int depth);
 size_t sec_desc_size(SEC_DESC *psd);
 BOOL sec_ace_equal(SEC_ACE *s1, SEC_ACE *s2);
 BOOL sec_acl_equal(SEC_ACL *s1, SEC_ACL *s2);
 BOOL sec_desc_equal(SEC_DESC *s1, SEC_DESC *s2);
-SEC_DESC_BUF *sec_desc_merge(SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb);
-SEC_DESC *make_sec_desc(uint16 revision, 
+SEC_DESC_BUF *sec_desc_merge(TALLOC_CTX *ctx, SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb);
+SEC_DESC *make_sec_desc(TALLOC_CTX *ctx, uint16 revision, 
 			DOM_SID *owner_sid, DOM_SID *grp_sid,
 			SEC_ACL *sacl, SEC_ACL *dacl, size_t *sd_size);
-SEC_DESC *dup_sec_desc( SEC_DESC *src);
-void free_sec_desc(SEC_DESC **ppsd);
-SEC_DESC *make_standard_sec_desc(DOM_SID *owner_sid, DOM_SID *grp_sid,
+SEC_DESC *dup_sec_desc( TALLOC_CTX *ctx, SEC_DESC *src);
+SEC_DESC *make_standard_sec_desc(TALLOC_CTX *ctx, DOM_SID *owner_sid, DOM_SID *grp_sid,
 				 SEC_ACL *dacl, size_t *sd_size);
 BOOL sec_io_desc(char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth);
-SEC_DESC_BUF *make_sec_desc_buf(size_t len, SEC_DESC *sec_desc);
-SEC_DESC_BUF *dup_sec_desc_buf(SEC_DESC_BUF *src);
-void free_sec_desc_buf(SEC_DESC_BUF **ppsdb);
+SEC_DESC_BUF *make_sec_desc_buf(TALLOC_CTX *ctx, size_t len, SEC_DESC *sec_desc);
+SEC_DESC_BUF *dup_sec_desc_buf(TALLOC_CTX *ctx, SEC_DESC_BUF *src);
 BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int depth);
 
 /*The following definitions come from  rpc_parse/parse_spoolss.c  */
@@ -2996,21 +2994,18 @@ BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int depth
 BOOL make_systemtime(SYSTEMTIME *systime, struct tm *unixtime);
 BOOL smb_io_notify_info_data_strings(char *desc,SPOOL_NOTIFY_INFO_DATA *data,
                                      prs_struct *ps, int depth);
-void free_spoolss_devmode(DEVICEMODE *devmode);
 BOOL make_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u,
 		const fstring printername, 
 		const fstring datatype, 
 		uint32 access_required,
 		const fstring clientname,
 		const fstring user_name);
-BOOL make_spoolss_q_addprinterex(SPOOL_Q_ADDPRINTEREX *q_u, const char *srv_name,
+BOOL make_spoolss_q_addprinterex(TALLOC_CTX *ctx, SPOOL_Q_ADDPRINTEREX *q_u, const char *srv_name,
 				 const char* clientname, const char* user_name,
 				 uint32 level, PRINTER_INFO_2 *info);
-void free_spoolss_q_addprinterex(SPOOL_Q_ADDPRINTEREX *q_u);
-BOOL make_spool_printer_info_2(SPOOL_PRINTER_INFO_LEVEL_2 **spool_info2, 
+BOOL make_spool_printer_info_2(TALLOC_CTX *ctx, SPOOL_PRINTER_INFO_LEVEL_2 **spool_info2, 
 			       PRINTER_INFO_2 *info);
 BOOL spoolss_io_q_open_printer_ex(char *desc, SPOOL_Q_OPEN_PRINTER_EX *q_u, prs_struct *ps, int depth);
-void free_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u);
 BOOL spoolss_io_r_open_printer_ex(char *desc, SPOOL_R_OPEN_PRINTER_EX *r_u, prs_struct *ps, int depth);
 BOOL make_spoolss_q_getprinterdata(SPOOL_Q_GETPRINTERDATA *q_u,
                                 const POLICY_HND *handle,
@@ -3054,8 +3049,6 @@ BOOL new_smb_io_job_info_1(char *desc, NEW_BUFFER *buffer, JOB_INFO_1 *info, int
 BOOL new_smb_io_job_info_2(char *desc, NEW_BUFFER *buffer, JOB_INFO_2 *info, int depth);
 BOOL new_smb_io_form_1(char *desc, NEW_BUFFER *buffer, FORM_1 *info, int depth);
 void new_spoolss_move_buffer(NEW_BUFFER *src, NEW_BUFFER **dest);
-BOOL new_spoolss_allocate_buffer(NEW_BUFFER **buffer);
-void new_spoolss_free_buffer(NEW_BUFFER *buffer);
 uint32 new_get_buffer_size(NEW_BUFFER *buffer);
 BOOL new_smb_io_driverdir_1(char *desc, NEW_BUFFER *buffer, DRIVER_DIRECTORY_1 *info, int depth);
 BOOL new_smb_io_port_1(char *desc, NEW_BUFFER *buffer, PORT_INFO_1 *info, int depth);
@@ -3103,7 +3096,6 @@ BOOL spoolss_io_q_getprinter(char *desc, SPOOL_Q_GETPRINTER *q_u, prs_struct *ps
 BOOL make_spoolss_q_getprinter(SPOOL_Q_GETPRINTER *q_u, const POLICY_HND *hnd, uint32 level, 
 				NEW_BUFFER *buffer, uint32 offered);
 BOOL spoolss_io_r_setprinter(char *desc, SPOOL_R_SETPRINTER *r_u, prs_struct *ps, int depth);
-void free_spoolss_q_setprinter(SPOOL_Q_SETPRINTER *q_u);
 BOOL spoolss_io_q_setprinter(char *desc, SPOOL_Q_SETPRINTER *q_u, prs_struct *ps, int depth);
 BOOL spoolss_io_r_fcpn(char *desc, SPOOL_R_FCPN *r_u, prs_struct *ps, int depth);
 BOOL spoolss_io_q_fcpn(char *desc, SPOOL_Q_FCPN *q_u, prs_struct *ps, int depth);
@@ -3143,23 +3135,17 @@ BOOL spoolss_io_r_addprinterex(char *desc, SPOOL_R_ADDPRINTEREX *r_u,
 			       prs_struct *ps, int depth);
 BOOL spool_io_printer_driver_info_level_3(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u, 
                                           prs_struct *ps, int depth);
-void free_spool_printer_driver_info_level_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u);
 BOOL spool_io_printer_driver_info_level_6(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u, 
                                           prs_struct *ps, int depth);
-void free_spool_printer_driver_info_level_6(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u);
 BOOL smb_io_unibuffer(char *desc, UNISTR2 *buffer, prs_struct *ps, int depth);
 BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL *il, prs_struct *ps, int depth);
-void free_spool_printer_driver_info_level(SPOOL_PRINTER_DRIVER_INFO_LEVEL *il);
-BOOL make_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u, 
+BOOL make_spoolss_q_addprinterdriver(TALLOC_CTX *ctx, SPOOL_Q_ADDPRINTERDRIVER *q_u, 
 				     const char* srv_name, uint32 level, 
 				     PRINTER_DRIVER_CTR *info);
-BOOL make_spool_driver_info_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *spool_drv_info,
+BOOL make_spool_driver_info_3(TALLOC_CTX *ctx, SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *spool_drv_info,
 			      DRIVER_INFO_3 *info3);
-void free_spool_driver_info_3 (SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *info);
-BOOL make_spool_buffer5(BUFFER5 *buf5, uint32 len, uint16 *src);
-void free_spool_buffer5(BUFFER5 *buf);
+BOOL make_spool_buffer5(TALLOC_CTX *ctx, BUFFER5 *buf5, uint32 len, uint16 *src);
 BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth);
-void free_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u);
 BOOL spoolss_io_r_addprinterdriver(char *desc, SPOOL_R_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth);
 BOOL uni_2_asc_printer_driver_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *uni,
                                 NT_PRINTER_DRIVER_INFO_LEVEL_3 **asc);
@@ -3184,7 +3170,6 @@ BOOL make_spoolss_q_enumprinterdata(SPOOL_Q_ENUMPRINTERDATA *q_u,
 		const POLICY_HND *hnd,
 		uint32 idx, uint32 valuelen, uint32 datalen);
 BOOL spoolss_io_q_setprinterdata(char *desc, SPOOL_Q_SETPRINTERDATA *q_u, prs_struct *ps, int depth);
-void free_spoolss_q_setprinterdata(SPOOL_Q_SETPRINTERDATA *q_u);
 BOOL spoolss_io_r_setprinterdata(char *desc, SPOOL_R_SETPRINTERDATA *r_u, prs_struct *ps, int depth);
 BOOL convert_specific_param(NT_PRINTER_PARAM **param, const UNISTR2 *value,
 				uint32 type, const uint8 *data, uint32 len);
@@ -3200,10 +3185,6 @@ void free_devmode(DEVICEMODE *devmode);
 void free_printer_info_1(PRINTER_INFO_1 *printer);
 void free_printer_info_2(PRINTER_INFO_2 *printer);
 void free_printer_info_3(PRINTER_INFO_3 *printer);
-void free_spool_printer_info_1(SPOOL_PRINTER_INFO_LEVEL_1 *printer);
-void free_spool_printer_info_2(SPOOL_PRINTER_INFO_LEVEL_2 *printer);
-void free_spool_printer_info_3(SPOOL_PRINTER_INFO_LEVEL_3 *printer);
-void free_spool_printer_info_level(SPOOL_PRINTER_INFO_LEVEL *pil);
 void free_print2_array(uint32 num_entries, PRINTER_INFO_2 **entries);
 void free_print1_array(uint32 num_entries, PRINTER_INFO_1 **entries);
 void free_job1_array(uint32 num_entries, JOB_INFO_1 **entries);
@@ -3436,7 +3417,7 @@ BOOL convert_devicemode(char *printername, const DEVICEMODE *devmode,
 				NT_DEVICEMODE **pp_nt_devmode);
 uint32 _spoolss_closeprinter(POLICY_HND *handle);
 uint32 _spoolss_deleteprinter(POLICY_HND *handle);
-uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
+uint32 _spoolss_getprinterdata(pipes_struct *p, POLICY_HND *handle, UNISTR2 *valuename,
 				uint32 in_size,
 				uint32 *type,
 				uint32 *out_size,
@@ -3445,9 +3426,8 @@ uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
 uint32 _spoolss_rffpcnex(POLICY_HND *handle, uint32 flags, uint32 options,
 			 const UNISTR2 *localmachine, uint32 printerlocal,
 			 SPOOL_NOTIFY_OPTION *option);
-uint32 _spoolss_rfnpcnex( POLICY_HND *handle, uint32 change,
-			  SPOOL_NOTIFY_OPTION *option, TALLOC_CTX *mem_ctx,
-			  SPOOL_NOTIFY_INFO *info);
+uint32 _spoolss_rfnpcnex( pipes_struct *p, POLICY_HND *handle, uint32 change,
+			  SPOOL_NOTIFY_OPTION *option, SPOOL_NOTIFY_INFO *info);
 uint32 _spoolss_enumprinters( uint32 flags, const UNISTR2 *servername, uint32 level,
 			      NEW_BUFFER *buffer, uint32 offered,
 			      uint32 *needed, uint32 *returned);
@@ -3503,7 +3483,7 @@ uint32 _spoolss_addprinterdriver(pipes_struct *p, const UNISTR2 *server_name,
 uint32 _spoolss_getprinterdriverdirectory(UNISTR2 *name, UNISTR2 *uni_environment, uint32 level,
 					NEW_BUFFER *buffer, uint32 offered,
 					uint32 *needed);
-uint32 _spoolss_enumprinterdata(POLICY_HND *handle, uint32 idx,
+uint32 _spoolss_enumprinterdata(pipes_struct *p, POLICY_HND *handle, uint32 idx,
 				uint32 in_value_len, uint32 in_data_len,
 				uint32 *out_max_value_len, uint16 **out_value, uint32 *out_value_len,
 				uint32 *out_type,
diff --git a/source3/include/rpc_secdes.h b/source3/include/rpc_secdes.h
index d32ab3f3e7..5d8a1895a6 100644
--- a/source3/include/rpc_secdes.h
+++ b/source3/include/rpc_secdes.h
@@ -105,6 +105,10 @@ typedef struct security_ace_info
 #define ACL_REVISION 0x3
 #endif
 
+#ifndef NT4_ACL_REVISION
+#define NT4_ACL_REVISION 0x2
+#endif
+
 #ifndef _SEC_ACL
 /* SEC_ACL */
 typedef struct security_acl_info
@@ -149,7 +153,7 @@ typedef struct security_descriptor_info
 typedef struct sec_desc_buf_info
 {
 	uint32 max_len;
-	uint32 undoc;
+	uint32 ptr;
 	uint32 len;
 
 	SEC_DESC *sec;
diff --git a/source3/lib/talloc.c b/source3/lib/talloc.c
index 854a230a0e..54a3d8ed76 100644
--- a/source3/lib/talloc.c
+++ b/source3/lib/talloc.c
@@ -139,3 +139,16 @@ void *talloc_zero(TALLOC_CTX *t, size_t size)
 
 	return p;
 }
+
+/* memdup with a talloc. */
+void *talloc_memdup(TALLOC_CTX *t, void *p, size_t size)
+{
+	void *newp = talloc(t,size);
+
+	if (!newp)
+		return 0;
+
+	memcpy(newp, p, size);
+
+	return newp;
+}
diff --git a/source3/lib/util_seaccess.c b/source3/lib/util_seaccess.c
index 6cfcd065aa..e1b18460e2 100644
--- a/source3/lib/util_seaccess.c
+++ b/source3/lib/util_seaccess.c
@@ -305,7 +305,7 @@ BOOL se_access_check(SEC_DESC *sd, struct current_user *user,
    the parent container.  This child object can either be a container or
    non-container object. */
 
-SEC_DESC_BUF *se_create_child_secdesc(SEC_DESC *parent_ctr, 
+SEC_DESC_BUF *se_create_child_secdesc(TALLOC_CTX *ctx, SEC_DESC *parent_ctr, 
 				      BOOL child_container)
 {
 	SEC_DESC_BUF *sdb;
@@ -321,7 +321,7 @@ SEC_DESC_BUF *se_create_child_secdesc(SEC_DESC *parent_ctr,
 
 	acl = parent_ctr->dacl;
 
-	if (!(new_ace_list = malloc(sizeof(SEC_ACE) * acl->num_aces))) 
+	if (!(new_ace_list = talloc(ctx, sizeof(SEC_ACE) * acl->num_aces))) 
 		return NULL;
 
 	for (i = 0; acl && i < acl->num_aces; i++) {
@@ -398,24 +398,19 @@ SEC_DESC_BUF *se_create_child_secdesc(SEC_DESC *parent_ctr,
 
 	/* Create child security descriptor to return */
 	
-	new_dacl = make_sec_acl(ACL_REVISION, new_ace_list_ndx, new_ace_list);
-	safe_free(new_ace_list);
+	new_dacl = make_sec_acl(ctx, ACL_REVISION, new_ace_list_ndx, new_ace_list);
 
 	/* Use the existing user and group sids.  I don't think this is
 	   correct.  Perhaps the user and group should be passed in as
 	   parameters by the caller? */
 
-	sd = make_sec_desc(SEC_DESC_REVISION,
+	sd = make_sec_desc(ctx, SEC_DESC_REVISION,
 			   parent_ctr->owner_sid,
 			   parent_ctr->grp_sid,
 			   parent_ctr->sacl,
 			   new_dacl, &size);
 
-	free_sec_acl(&new_dacl);
-
-	sdb = make_sec_desc_buf(size, sd);
-
-	free_sec_desc(&sd);
+	sdb = make_sec_desc_buf(ctx, size, sd);
 
 	return sdb;
 }
diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index 83c3206a7d..32014f062c 100644
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -2022,7 +2022,6 @@ static void free_nt_printer_info_level_2(NT_PRINTER_INFO_LEVEL_2 **info_ptr)
 	DEBUG(106,("free_nt_printer_info_level_2: deleting info\n"));
 
 	free_nt_devicemode(&info->devmode);
-	free_sec_desc_buf(&info->secdesc_buf);
 
 	for(param_ptr = info->specific; param_ptr; ) {
 		NT_PRINTER_PARAM *tofree = param_ptr;
@@ -2192,7 +2191,10 @@ static uint32 get_a_printer_2_default(NT_PRINTER_INFO_LEVEL_2 **info_ptr, fstrin
 		goto fail;
 #endif
 
-	if (!nt_printing_getsec(sharename, &info.secdesc_buf))
+	/* This will get the current RPC talloc context, but we should be
+	   passing this as a parameter... fixme... JRA ! */
+
+	if (!nt_printing_getsec(get_talloc_ctx(), sharename, &info.secdesc_buf))
 		goto fail;
 
 	*info_ptr = (NT_PRINTER_INFO_LEVEL_2 *)memdup(&info, sizeof(info));
@@ -2207,8 +2209,6 @@ static uint32 get_a_printer_2_default(NT_PRINTER_INFO_LEVEL_2 **info_ptr, fstrin
 
 	if (info.devmode)
 		free_nt_devicemode(&info.devmode);
-	if (info.secdesc_buf)
-		free_sec_desc_buf(&info.secdesc_buf);
 	return 2;
 }
 
@@ -2270,7 +2270,10 @@ static uint32 get_a_printer_2(NT_PRINTER_INFO_LEVEL_2 **info_ptr, fstring sharen
 	len += unpack_devicemode(&info.devmode,dbuf.dptr+len, dbuf.dsize-len);
 	len += unpack_specifics(&info.specific,dbuf.dptr+len, dbuf.dsize-len);
 
-	nt_printing_getsec(sharename, &info.secdesc_buf);
+	/* This will get the current RPC talloc context, but we should be
+       passing this as a parameter... fixme... JRA ! */
+
+	nt_printing_getsec(get_talloc_ctx(), sharename, &info.secdesc_buf);
 
 	safe_free(dbuf.dptr);
 	*info_ptr=memdup(&info, sizeof(info));
@@ -2651,7 +2654,7 @@ BOOL get_specific_param(NT_PRINTER_INFO_LEVEL printer, uint32 level,
 	/* right now that's enough ! */	
 	NT_PRINTER_PARAM *param;
 	
-	DEBUG(105, ("get_specific_param\n"));
+	DEBUG(10, ("get_specific_param\n"));
 	
 	param=printer.info_2->specific;
 		
@@ -2668,9 +2671,9 @@ BOOL get_specific_param(NT_PRINTER_INFO_LEVEL printer, uint32 level,
 		param=param->next;
 	}
 	
-	DEBUG(106, ("found one param\n"));
 	if (param != NULL)
 	{
+        DEBUGADD(10, ("get_specific_param: found one param\n"));
 		/* exited because it exist */
 		*type=param->type;	
 		
@@ -2680,10 +2683,10 @@ BOOL get_specific_param(NT_PRINTER_INFO_LEVEL printer, uint32 level,
 		memcpy(*data, param->data, param->data_len);
 		*len=param->data_len;
 
-		DEBUG(106, ("exit of get_specific_param:true\n"));
+		DEBUGADD(10, ("get_specific_param: exit true\n"));
 		return (True);
 	}
-	DEBUG(106, ("exit of get_specific_param:false\n"));
+	DEBUGADD(10, ("get_specific_param: exit false\n"));
 	return (False);
 }
 
@@ -2715,7 +2718,7 @@ uint32 nt_printing_setsec(char *printername, SEC_DESC_BUF *secdesc_ctr)
 		SEC_DESC *psd = NULL;
 		size_t size;
 
-		nt_printing_getsec(printername, &old_secdesc_ctr);
+		nt_printing_getsec(mem_ctx, printername, &old_secdesc_ctr);
 
 		/* Pick out correct owner and group sids */
 
@@ -2737,18 +2740,13 @@ uint32 nt_printing_setsec(char *printername, SEC_DESC_BUF *secdesc_ctr)
 
 		/* Make a deep copy of the security descriptor */
 
-		psd = make_sec_desc(secdesc_ctr->sec->revision,
+		psd = make_sec_desc(mem_ctx, secdesc_ctr->sec->revision,
 				    owner_sid, group_sid,
 				    sacl,
 				    dacl,
 				    &size);
 
-		new_secdesc_ctr = make_sec_desc_buf(size, psd);
-
-		/* Free up memory */
-
-		free_sec_desc(&psd);
-		free_sec_desc_buf(&old_secdesc_ctr);
+		new_secdesc_ctr = make_sec_desc_buf(mem_ctx, size, psd);
 	}
 
 	if (!new_secdesc_ctr) {
@@ -2778,11 +2776,6 @@ uint32 nt_printing_setsec(char *printername, SEC_DESC_BUF *secdesc_ctr)
 	/* Free mallocated memory */
 
  out:
-	free_sec_desc_buf(&old_secdesc_ctr);
-
-	if (new_secdesc_ctr != secdesc_ctr) {
-		free_sec_desc_buf(&new_secdesc_ctr);
-	}
 
 	prs_mem_free(&ps);
 	if (mem_ctx)
@@ -2794,7 +2787,7 @@ uint32 nt_printing_setsec(char *printername, SEC_DESC_BUF *secdesc_ctr)
  Construct a default security descriptor buffer for a printer.
 ****************************************************************************/
 
-static SEC_DESC_BUF *construct_default_printer_sdb(void)
+static SEC_DESC_BUF *construct_default_printer_sdb(TALLOC_CTX *ctx)
 {
 	SEC_ACE ace[3];
 	SEC_ACCESS sa;
@@ -2844,13 +2837,10 @@ static SEC_DESC_BUF *construct_default_printer_sdb(void)
 	   descriptors.  NT4 complains about the property being edited by a
 	   NT5 machine. */
 
-#define NT4_ACL_REVISION 0x2
-
-	if ((psa = make_sec_acl(NT4_ACL_REVISION, 3, ace)) != NULL) {
-		psd = make_sec_desc(SEC_DESC_REVISION,
+	if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) != NULL) {
+		psd = make_sec_desc(ctx, SEC_DESC_REVISION,
 				    &owner_sid, NULL,
 				    NULL, psa, &sd_size);
-		free_sec_acl(&psa);
 	}
 
 	if (!psd) {
@@ -2858,12 +2848,11 @@ static SEC_DESC_BUF *construct_default_printer_sdb(void)
 		return NULL;
 	}
 
-	sdb = make_sec_desc_buf(sd_size, psd);
+	sdb = make_sec_desc_buf(ctx, sd_size, psd);
 
 	DEBUG(4,("construct_default_printer_sdb: size = %u.\n",
 		 (unsigned int)sd_size));
 
-	free_sec_desc(&psd);
 	return sdb;
 }
 
@@ -2871,17 +2860,12 @@ static SEC_DESC_BUF *construct_default_printer_sdb(void)
  Get a security desc for a printer.
 ****************************************************************************/
 
-BOOL nt_printing_getsec(char *printername, SEC_DESC_BUF **secdesc_ctr)
+BOOL nt_printing_getsec(TALLOC_CTX *ctx, char *printername, SEC_DESC_BUF **secdesc_ctr)
 {
 	prs_struct ps;
-	TALLOC_CTX *mem_ctx = NULL;
 	fstring key;
 	char *temp;
 
-	mem_ctx = talloc_init();
-	if (mem_ctx == NULL)
-		return False;
-
 	if ((temp = strchr(printername + 2, '\\'))) {
 		printername = temp + 1;
 	}
@@ -2890,17 +2874,15 @@ BOOL nt_printing_getsec(char *printername, SEC_DESC_BUF **secdesc_ctr)
 
 	slprintf(key, sizeof(key), "SECDESC/%s", printername);
 
-	if (tdb_prs_fetch(tdb, key, &ps, mem_ctx)!=0 ||
+	if (tdb_prs_fetch(tdb, key, &ps, ctx)!=0 ||
 	    !sec_io_desc_buf("nt_printing_getsec", secdesc_ctr, &ps, 1)) {
 
 		DEBUG(4,("using default secdesc for %s\n", printername));
 
-		if (!(*secdesc_ctr = construct_default_printer_sdb())) {
-			talloc_destroy(mem_ctx);
+		if (!(*secdesc_ctr = construct_default_printer_sdb(ctx))) {
 			return False;
 		}
 
-		talloc_destroy(mem_ctx);
 		return True;
 	}
 
@@ -2924,20 +2906,17 @@ BOOL nt_printing_getsec(char *printername, SEC_DESC_BUF **secdesc_ctr)
 
 			sid_append_rid(&owner_sid, DOMAIN_USER_RID_ADMIN);
 
-			psd = make_sec_desc((*secdesc_ctr)->sec->revision,
+			psd = make_sec_desc(ctx, (*secdesc_ctr)->sec->revision,
 					    &owner_sid,
 					    (*secdesc_ctr)->sec->grp_sid,
 					    (*secdesc_ctr)->sec->sacl,
 					    (*secdesc_ctr)->sec->dacl,
 					    &size);
 
-			new_secdesc_ctr = make_sec_desc_buf(size, psd);
-
-			free_sec_desc(&psd);
+			new_secdesc_ctr = make_sec_desc_buf(ctx, size, psd);
 
 			/* Swap with other one */
 
-			free_sec_desc_buf(secdesc_ctr);
 			*secdesc_ctr = new_secdesc_ctr;
 
 			/* Set it */
@@ -2965,7 +2944,6 @@ BOOL nt_printing_getsec(char *printername, SEC_DESC_BUF **secdesc_ctr)
 	}
 
 	prs_mem_free(&ps);
-	talloc_destroy(mem_ctx);
 	return True;
 }
 
@@ -3043,6 +3021,7 @@ BOOL print_access_check(struct current_user *user, int snum, int access_type)
 	uint32 access_granted, status;
 	BOOL result;
 	char *pname;
+	TALLOC_CTX *mem_ctx = NULL;
 	extern struct current_user current_user;
 	
 	/* If user is NULL then use the current_user structure */
@@ -3067,7 +3046,12 @@ BOOL print_access_check(struct current_user *user, int snum, int access_type)
 
 	/* Get printer security descriptor */
 
-	nt_printing_getsec(pname, &secdesc);
+	if(!(mem_ctx = talloc_init())) {
+		errno = ENOMEM;
+		return False;
+	}
+
+	nt_printing_getsec(mem_ctx, pname, &secdesc);
 
 	if (access_type == JOB_ACCESS_ADMINISTER) {
 		SEC_DESC_BUF *parent_secdesc = secdesc;
@@ -3076,9 +3060,7 @@ BOOL print_access_check(struct current_user *user, int snum, int access_type)
 		   against.  This is because print jobs are child objects
 		   objects of a printer. */
 
-		secdesc = se_create_child_secdesc(parent_secdesc->sec, False);
-
-		free_sec_desc_buf(&parent_secdesc);
+		secdesc = se_create_child_secdesc(mem_ctx, parent_secdesc->sec, False);
 
 		/* Now this is the bit that really confuses me.  The access
 		   type needs to be changed from JOB_ACCESS_ADMINISTER to
@@ -3097,11 +3079,9 @@ BOOL print_access_check(struct current_user *user, int snum, int access_type)
 				 &access_granted, &status);
 
 	DEBUG(4, ("access check was %s\n", result ? "SUCCESS" : "FAILURE"));
-	
-	/* Free mallocated memory */
-
-	free_sec_desc_buf(&secdesc);
 
+	talloc_destroy(mem_ctx);
+	
 	if (!result)
 		errno = EACCES;
 
@@ -3215,5 +3195,4 @@ uint32 printer_write_default_dev(int snum, const PRINTER_DEFAULT *printer_defaul
 	free_a_printer(&printer, 2);
 	return result;
 }
-
 #undef OLD_NTDOMAIN
diff --git a/source3/rpc_client/cli_reg.c b/source3/rpc_client/cli_reg.c
index b45ac0d033..96e27c5ce6 100644
--- a/source3/rpc_client/cli_reg.c
+++ b/source3/rpc_client/cli_reg.c
@@ -708,19 +708,17 @@ BOOL do_reg_create_key(struct cli_state *cli, POLICY_HND *hnd,
 	DEBUG(4,("REG Create Key: %s %s 0x%08x\n", key_name, key_class,
 		sam_access != NULL ? sam_access->mask : 0));
 
-	if((sec = make_sec_desc( 1, NULL, NULL, NULL, NULL, &sec_len)) == NULL) {
+	if((sec = make_sec_desc( cli->mem_ctx, 1, NULL, NULL, NULL, NULL, &sec_len)) == NULL) {
 		DEBUG(0,("make_sec_desc : malloc fail.\n"));
 		return False;
 	}
 
 	DEBUG(10,("make_sec_desc: len = %d\n", (int)sec_len));
 
-	if((sec_buf = make_sec_desc_buf( (int)sec_len, sec)) == NULL) {
+	if((sec_buf = make_sec_desc_buf( cli->mem_ctx, (int)sec_len, sec)) == NULL) {
 		DEBUG(0,("make_sec_desc : malloc fail (1)\n"));
-		free_sec_desc(&sec);
 		return False;
 	}
-	free_sec_desc(&sec);
 
 	prs_init(&buf, MAX_PDU_FRAG_LEN, 4, cli->mem_ctx, MARSHALL);
 	prs_init(&rbuf, 0, 4, cli->mem_ctx, UNMARSHALL);
@@ -729,7 +727,6 @@ BOOL do_reg_create_key(struct cli_state *cli, POLICY_HND *hnd,
 
 	/* turn parameters into data stream */
 	if(!reg_io_q_create_key("", &q_o, &buf, 0)) {
-		free_sec_desc_buf(&sec_buf);
 		prs_mem_free(&buf);
 		prs_mem_free(&rbuf);
 		return False;
@@ -737,13 +734,11 @@ BOOL do_reg_create_key(struct cli_state *cli, POLICY_HND *hnd,
 
 	/* send the data on \PIPE\ */
 	if (rpc_api_pipe_req(cli, REG_CREATE_KEY, &buf, &rbuf)) {
-		free_sec_desc_buf(&sec_buf);
 		prs_mem_free(&buf);
 		prs_mem_free(&rbuf);
 		return False;
 	}
 
-	free_sec_desc_buf(&sec_buf);
 	prs_mem_free(&buf);
 
 	ZERO_STRUCT(r_o);
diff --git a/source3/rpc_client/cli_spoolss.c b/source3/rpc_client/cli_spoolss.c
index 3517fbbc9c..461bddefaf 100644
--- a/source3/rpc_client/cli_spoolss.c
+++ b/source3/rpc_client/cli_spoolss.c
@@ -584,7 +584,6 @@ BOOL spoolss_addprinterex(POLICY_HND *hnd, const char* srv_name, PRINTER_INFO_2
 
         prs_mem_free(&rbuf);
         prs_mem_free(&buf );
-	free_spoolss_q_addprinterex(&q_o);
 
 	if (mem_ctx)
 		talloc_destroy(mem_ctx);
@@ -813,7 +812,6 @@ uint32 spoolss_addprinterdriver(const char *srv_name, uint32 level, PRINTER_DRIV
 
         prs_mem_free(&rbuf);
         prs_mem_free(&buf );
-	free_spool_driver_info_3(q_o.info.info_3);
 
 	if (mem_ctx)
 		talloc_destroy(mem_ctx);
diff --git a/source3/rpc_parse/parse_sec.c b/source3/rpc_parse/parse_sec.c
index fa0be04cba..e5d3a6ce43 100644
--- a/source3/rpc_parse/parse_sec.c
+++ b/source3/rpc_parse/parse_sec.c
@@ -123,22 +123,19 @@ BOOL sec_io_ace(char *desc, SEC_ACE *psa, prs_struct *ps, int depth)
  Create a SEC_ACL structure.  
 ********************************************************************/
 
-SEC_ACL *make_sec_acl(uint16 revision, int num_aces, SEC_ACE *ace_list)
+SEC_ACL *make_sec_acl(TALLOC_CTX *ctx, uint16 revision, int num_aces, SEC_ACE *ace_list)
 {
 	SEC_ACL *dst;
 	int i;
 
-	if((dst = (SEC_ACL *)malloc(sizeof(SEC_ACL))) == NULL)
+	if((dst = (SEC_ACL *)talloc_zero(ctx,sizeof(SEC_ACL))) == NULL)
 		return NULL;
 
-	ZERO_STRUCTP(dst);
-
 	dst->revision = revision;
 	dst->num_aces = num_aces;
 	dst->size = 8;
 
-	if((dst->ace = (SEC_ACE *)malloc( sizeof(SEC_ACE) * num_aces )) == NULL) {
-		free_sec_acl(&dst);
+	if((dst->ace = (SEC_ACE *)talloc(ctx, sizeof(SEC_ACE) * num_aces )) == NULL) {
 		return NULL;
 	}
 
@@ -154,31 +151,12 @@ SEC_ACL *make_sec_acl(uint16 revision, int num_aces, SEC_ACE *ace_list)
  Duplicate a SEC_ACL structure.  
 ********************************************************************/
 
-SEC_ACL *dup_sec_acl( SEC_ACL *src)
+SEC_ACL *dup_sec_acl(TALLOC_CTX *ctx, SEC_ACL *src)
 {
 	if(src == NULL)
 		return NULL;
 
-	return make_sec_acl( src->revision, src->num_aces, src->ace);
-}
-
-/*******************************************************************
- Delete a SEC_ACL structure.  
-********************************************************************/
-
-void free_sec_acl(SEC_ACL **ppsa)
-{
-	SEC_ACL *psa;
-
-	if(ppsa == NULL || *ppsa == NULL)
-		return;
-
-	psa = *ppsa;
-	if (psa->ace != NULL)
-		free(psa->ace);
-
-	free(psa);
-	*ppsa = NULL;
+	return make_sec_acl(ctx, src->revision, src->num_aces, src->ace);
 }
 
 /*******************************************************************
@@ -204,7 +182,7 @@ BOOL sec_io_acl(char *desc, SEC_ACL **ppsa, prs_struct *ps, int depth)
 		/*
 		 * This is a read and we must allocate the stuct to read into.
 		 */
-		if((psa = (SEC_ACL *)malloc(sizeof(SEC_ACL))) == NULL)
+		if((psa = (SEC_ACL *)prs_alloc_mem(ps, sizeof(SEC_ACL))) == NULL)
 			return False;
 		*ppsa = psa;
 	}
@@ -228,7 +206,7 @@ BOOL sec_io_acl(char *desc, SEC_ACL **ppsa, prs_struct *ps, int depth)
 
 	if (UNMARSHALLING(ps) && psa->num_aces != 0) {
 		/* reading */
-		if((psa->ace = malloc(sizeof(psa->ace[0]) * psa->num_aces)) == NULL)
+		if((psa->ace = (SEC_ACE *)prs_alloc_mem(ps,sizeof(psa->ace[0]) * psa->num_aces)) == NULL)
 			return False;
 	}
 
@@ -423,7 +401,7 @@ BOOL sec_desc_equal(SEC_DESC *s1, SEC_DESC *s2)
  security descriptor new_sec.
 ********************************************************************/
 
-SEC_DESC_BUF *sec_desc_merge(SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb)
+SEC_DESC_BUF *sec_desc_merge(TALLOC_CTX *ctx, SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb)
 {
 	DOM_SID *owner_sid, *group_sid;
 	SEC_DESC_BUF *return_sdb;
@@ -460,21 +438,37 @@ SEC_DESC_BUF *sec_desc_merge(SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb)
 
 	/* Create new security descriptor from bits */
 
-	psd = make_sec_desc(new_sdb->sec->revision, 
+	psd = make_sec_desc(ctx, new_sdb->sec->revision, 
 			    owner_sid, group_sid, sacl, dacl, &secdesc_size);
 
-	return_sdb = make_sec_desc_buf(secdesc_size, psd);
-
-	free_sec_desc(&psd);
+	return_sdb = make_sec_desc_buf(ctx, secdesc_size, psd);
 
 	return(return_sdb);
 }
 
 /*******************************************************************
+ Tallocs a duplicate SID. 
+********************************************************************/ 
+
+static DOM_SID *sid_dup_talloc(TALLOC_CTX *ctx, DOM_SID *src)
+{
+  DOM_SID *dst;
+
+  if(!src)
+    return NULL;
+
+  if((dst = talloc_zero(ctx, sizeof(DOM_SID))) != NULL) {
+    sid_copy( dst, src);
+  }
+
+  return dst;
+}
+
+/*******************************************************************
  Creates a SEC_DESC structure
 ********************************************************************/
 
-SEC_DESC *make_sec_desc(uint16 revision, 
+SEC_DESC *make_sec_desc(TALLOC_CTX *ctx, uint16 revision, 
 			DOM_SID *owner_sid, DOM_SID *grp_sid,
 			SEC_ACL *sacl, SEC_ACL *dacl, size_t *sd_size)
 {
@@ -483,11 +477,9 @@ SEC_DESC *make_sec_desc(uint16 revision,
 
 	*sd_size = 0;
 
-	if(( dst = (SEC_DESC *)malloc(sizeof(SEC_DESC))) == NULL)
+	if(( dst = (SEC_DESC *)talloc_zero(ctx, sizeof(SEC_DESC))) == NULL)
 		return NULL;
 
-	ZERO_STRUCTP(dst);
-
 	dst->revision = revision;
 	dst->type     = SEC_DESC_SELF_RELATIVE;
 
@@ -499,16 +491,16 @@ SEC_DESC *make_sec_desc(uint16 revision,
 	dst->off_sacl      = 0;
 	dst->off_dacl      = 0;
 
-	if(owner_sid && ((dst->owner_sid = sid_dup(owner_sid)) == NULL))
+	if(owner_sid && ((dst->owner_sid = sid_dup_talloc(ctx,owner_sid)) == NULL))
 		goto error_exit;
 
-	if(grp_sid && ((dst->grp_sid = sid_dup(grp_sid)) == NULL))
+	if(grp_sid && ((dst->grp_sid = sid_dup_talloc(ctx,grp_sid)) == NULL))
 		goto error_exit;
 
-	if(sacl && ((dst->sacl = dup_sec_acl(sacl)) == NULL))
+	if(sacl && ((dst->sacl = dup_sec_acl(ctx, sacl)) == NULL))
 		goto error_exit;
 
-	if(dacl && ((dst->dacl = dup_sec_acl(dacl)) == NULL))
+	if(dacl && ((dst->dacl = dup_sec_acl(ctx, dacl)) == NULL))
 		goto error_exit;
 		
 	offset = 0;
@@ -559,7 +551,6 @@ SEC_DESC *make_sec_desc(uint16 revision,
 error_exit:
 
 	*sd_size = 0;
-	free_sec_desc(&dst);
 	return NULL;
 }
 
@@ -567,47 +558,26 @@ error_exit:
  Duplicate a SEC_DESC structure.  
 ********************************************************************/
 
-SEC_DESC *dup_sec_desc( SEC_DESC *src)
+SEC_DESC *dup_sec_desc( TALLOC_CTX *ctx, SEC_DESC *src)
 {
 	size_t dummy;
 
 	if(src == NULL)
 		return NULL;
 
-	return make_sec_desc( src->revision, 
+	return make_sec_desc( ctx, src->revision, 
 				src->owner_sid, src->grp_sid, src->sacl,
 				src->dacl, &dummy);
 }
 
 /*******************************************************************
- Deletes a SEC_DESC structure
-********************************************************************/
-
-void free_sec_desc(SEC_DESC **ppsd)
-{
-	SEC_DESC *psd;
-
-	if(ppsd == NULL || *ppsd == NULL)
-		return;
-
-	psd = *ppsd;
-
-	free_sec_acl(&psd->dacl);
-	free_sec_acl(&psd->sacl);
-	free(psd->owner_sid);
-	free(psd->grp_sid);
-	free(psd);
-	*ppsd = NULL;
-}
-
-/*******************************************************************
  Creates a SEC_DESC structure with typical defaults.
 ********************************************************************/
 
-SEC_DESC *make_standard_sec_desc(DOM_SID *owner_sid, DOM_SID *grp_sid,
+SEC_DESC *make_standard_sec_desc(TALLOC_CTX *ctx, DOM_SID *owner_sid, DOM_SID *grp_sid,
 				 SEC_ACL *dacl, size_t *sd_size)
 {
-	return make_sec_desc(SEC_DESC_REVISION,
+	return make_sec_desc(ctx, SEC_DESC_REVISION,
 			     owner_sid, grp_sid, NULL, dacl, sd_size);
 }
 
@@ -629,7 +599,7 @@ BOOL sec_io_desc(char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth)
 
 	if (psd == NULL) {
 		if(UNMARSHALLING(ps)) {
-			if((psd = (SEC_DESC *)malloc(sizeof(SEC_DESC))) == NULL)
+			if((psd = (SEC_DESC *)prs_alloc_mem(ps,sizeof(SEC_DESC))) == NULL)
 				return False;
 			*ppsd = psd;
 		} else {
@@ -673,7 +643,7 @@ BOOL sec_io_desc(char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth)
 			if(!prs_set_offset(ps, old_offset + psd->off_owner_sid))
 				return False;
 			/* reading */
-			if((psd->owner_sid = malloc(sizeof(*psd->owner_sid))) == NULL)
+			if((psd->owner_sid = (DOM_SID *)prs_alloc_mem(ps,sizeof(*psd->owner_sid))) == NULL)
 				return False;
 		}
 
@@ -691,7 +661,7 @@ BOOL sec_io_desc(char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth)
 			/* reading */
 			if(!prs_set_offset(ps, old_offset + psd->off_grp_sid))
 				return False;
-			if((psd->grp_sid = malloc(sizeof(*psd->grp_sid))) == NULL)
+			if((psd->grp_sid = (DOM_SID *)prs_alloc_mem(ps,sizeof(*psd->grp_sid))) == NULL)
 				return False;
 		}
 
@@ -734,24 +704,23 @@ BOOL sec_io_desc(char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth)
  Creates a SEC_DESC_BUF structure.
 ********************************************************************/
 
-SEC_DESC_BUF *make_sec_desc_buf(size_t len, SEC_DESC *sec_desc)
+SEC_DESC_BUF *make_sec_desc_buf(TALLOC_CTX *ctx, size_t len, SEC_DESC *sec_desc)
 {
 	SEC_DESC_BUF *dst;
 
-	if((dst = (SEC_DESC_BUF *)malloc(sizeof(SEC_DESC_BUF))) == NULL)
+	if((dst = (SEC_DESC_BUF *)talloc_zero(ctx, sizeof(SEC_DESC_BUF))) == NULL)
 		return NULL;
 
-	ZERO_STRUCTP(dst);
-
 	/* max buffer size (allocated size) */
 	dst->max_len = (uint32)len;
 	dst->len = (uint32)len;
-
-	if(sec_desc && ((dst->sec = dup_sec_desc(sec_desc)) == NULL)) {
-		free_sec_desc_buf(&dst);
+	
+	if(sec_desc && ((dst->sec = dup_sec_desc(ctx, sec_desc)) == NULL)) {
 		return NULL;
 	}
 
+	dst->ptr = 0x1;
+
 	return dst;
 }
 
@@ -759,32 +728,14 @@ SEC_DESC_BUF *make_sec_desc_buf(size_t len, SEC_DESC *sec_desc)
  Duplicates a SEC_DESC_BUF structure.
 ********************************************************************/
 
-SEC_DESC_BUF *dup_sec_desc_buf(SEC_DESC_BUF *src)
+SEC_DESC_BUF *dup_sec_desc_buf(TALLOC_CTX *ctx, SEC_DESC_BUF *src)
 {
 	if(src == NULL)
 		return NULL;
 
-	return make_sec_desc_buf( src->len, src->sec);
-}
-
-/*******************************************************************
- Deletes a SEC_DESC_BUF structure.
-********************************************************************/
-
-void free_sec_desc_buf(SEC_DESC_BUF **ppsdb)
-{
-	SEC_DESC_BUF *psdb;
-
-	if(ppsdb == NULL || *ppsdb == NULL)
-		return;
-
-	psdb = *ppsdb;
-	free_sec_desc(&psdb->sec);
-	free(psdb);
-	*ppsdb = NULL;
+	return make_sec_desc_buf( ctx, src->len, src->sec);
 }
 
-
 /*******************************************************************
  Reads or writes a SEC_DESC_BUF structure.
 ********************************************************************/
@@ -803,7 +754,7 @@ BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int depth
 	psdb = *ppsdb;
 
 	if (UNMARSHALLING(ps) && psdb == NULL) {
-		if((psdb = (SEC_DESC_BUF *)malloc(sizeof(SEC_DESC_BUF))) == NULL)
+		if((psdb = (SEC_DESC_BUF *)prs_alloc_mem(ps,sizeof(SEC_DESC_BUF))) == NULL)
 			return False;
 		*ppsdb = psdb;
 	}
@@ -817,7 +768,7 @@ BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int depth
 	if(!prs_uint32_pre("max_len", ps, depth, &psdb->max_len, &off_max_len))
 		return False;
 
-	if(!prs_uint32    ("undoc  ", ps, depth, &psdb->undoc))
+	if(!prs_uint32    ("ptr  ", ps, depth, &psdb->ptr))
 		return False;
 
 	if(!prs_uint32_pre("len    ", ps, depth, &psdb->len, &off_len))
diff --git a/source3/rpc_parse/parse_spoolss.c b/source3/rpc_parse/parse_spoolss.c
index bb8c818421..fb4150b2ce 100644
--- a/source3/rpc_parse/parse_spoolss.c
+++ b/source3/rpc_parse/parse_spoolss.c
@@ -25,25 +25,28 @@
 #include "includes.h"
 
 extern int DEBUGLEVEL;
+
 /*******************************************************************
 return the length of a UNISTR string.
 ********************************************************************/  
+
 static uint32 str_len_uni(UNISTR *source)
 {
  	uint32 i=0;
 
-	if (!source->buffer) return 0;
+	if (!source->buffer)
+		return 0;
+
+	while (source->buffer[i])
+		i++;
 
-	while (source->buffer[i]!=0x0000)
-	{
-	 i++;
-	}
 	return i;
 }
 
 /*******************************************************************
 This should be moved in a more generic lib.
 ********************************************************************/  
+
 static BOOL spoolss_io_system_time(char *desc, prs_struct *ps, int depth, SYSTEMTIME *systime)
 {
 	if(!prs_uint16("year", ps, depth, &(systime->year)))
@@ -68,6 +71,7 @@ static BOOL spoolss_io_system_time(char *desc, prs_struct *ps, int depth, SYSTEM
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL make_systemtime(SYSTEMTIME *systime, struct tm *unixtime)
 {
 	systime->year=unixtime->tm_year+1900;
@@ -85,6 +89,7 @@ BOOL make_systemtime(SYSTEMTIME *systime, struct tm *unixtime)
 /*******************************************************************
 reads or writes an DOC_INFO structure.
 ********************************************************************/  
+
 static BOOL smb_io_doc_info_1(char *desc, DOC_INFO_1 *info_1, prs_struct *ps, int depth)
 {
 	if (info_1 == NULL) return False;
@@ -115,6 +120,7 @@ static BOOL smb_io_doc_info_1(char *desc, DOC_INFO_1 *info_1, prs_struct *ps, in
 /*******************************************************************
 reads or writes an DOC_INFO structure.
 ********************************************************************/  
+
 static BOOL smb_io_doc_info(char *desc, DOC_INFO *info, prs_struct *ps, int depth)
 {
 	uint32 useless_ptr=0;
@@ -163,6 +169,7 @@ static BOOL smb_io_doc_info(char *desc, DOC_INFO *info, prs_struct *ps, int dept
 /*******************************************************************
 reads or writes an DOC_INFO_CONTAINER structure.
 ********************************************************************/  
+
 static BOOL smb_io_doc_info_container(char *desc, DOC_INFO_CONTAINER *cont, prs_struct *ps, int depth)
 {
 	if (cont == NULL) return False;
@@ -185,6 +192,7 @@ static BOOL smb_io_doc_info_container(char *desc, DOC_INFO_CONTAINER *cont, prs_
 /*******************************************************************
 reads or writes an NOTIFY OPTION TYPE structure.
 ********************************************************************/  
+
 static BOOL smb_io_notify_option_type(char *desc, SPOOL_NOTIFY_OPTION_TYPE *type, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "smb_io_notify_option_type");
@@ -212,6 +220,7 @@ static BOOL smb_io_notify_option_type(char *desc, SPOOL_NOTIFY_OPTION_TYPE *type
 /*******************************************************************
 reads or writes an NOTIFY OPTION TYPE DATA.
 ********************************************************************/  
+
 static BOOL smb_io_notify_option_type_data(char *desc, SPOOL_NOTIFY_OPTION_TYPE *type, prs_struct *ps, int depth)
 {
 	int i;
@@ -242,6 +251,7 @@ static BOOL smb_io_notify_option_type_data(char *desc, SPOOL_NOTIFY_OPTION_TYPE
 /*******************************************************************
 reads or writes an NOTIFY OPTION structure.
 ********************************************************************/  
+
 static BOOL smb_io_notify_option_type_ctr(char *desc, SPOOL_NOTIFY_OPTION_TYPE_CTR *ctr , prs_struct *ps, int depth)
 {		
 	int i;
@@ -254,7 +264,7 @@ static BOOL smb_io_notify_option_type_ctr(char *desc, SPOOL_NOTIFY_OPTION_TYPE_C
 
 	/* reading */
 	if (UNMARSHALLING(ps))
-		if((ctr->type=(SPOOL_NOTIFY_OPTION_TYPE *)malloc(ctr->count*sizeof(SPOOL_NOTIFY_OPTION_TYPE))) == NULL)
+		if((ctr->type=(SPOOL_NOTIFY_OPTION_TYPE *)prs_alloc_mem(ps,ctr->count*sizeof(SPOOL_NOTIFY_OPTION_TYPE))) == NULL)
 			return False;
 		
 	/* the option type struct */
@@ -273,6 +283,7 @@ static BOOL smb_io_notify_option_type_ctr(char *desc, SPOOL_NOTIFY_OPTION_TYPE_C
 /*******************************************************************
 reads or writes an NOTIFY OPTION structure.
 ********************************************************************/  
+
 static BOOL smb_io_notify_option(char *desc, SPOOL_NOTIFY_OPTION *option, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "smb_io_notify_option");
@@ -303,6 +314,7 @@ static BOOL smb_io_notify_option(char *desc, SPOOL_NOTIFY_OPTION *option, prs_st
 /*******************************************************************
 reads or writes an NOTIFY INFO DATA structure.
 ********************************************************************/  
+
 static BOOL smb_io_notify_info_data(char *desc,SPOOL_NOTIFY_INFO_DATA *data, prs_struct *ps, int depth)
 {
 	uint32 useless_ptr=0xADDE0FF0;
@@ -362,6 +374,7 @@ static BOOL smb_io_notify_info_data(char *desc,SPOOL_NOTIFY_INFO_DATA *data, prs
 /*******************************************************************
 reads or writes an NOTIFY INFO DATA structure.
 ********************************************************************/  
+
 BOOL smb_io_notify_info_data_strings(char *desc,SPOOL_NOTIFY_INFO_DATA *data,
                                      prs_struct *ps, int depth)
 {
@@ -401,10 +414,7 @@ BOOL smb_io_notify_info_data_strings(char *desc,SPOOL_NOTIFY_INFO_DATA *data,
 
 			/* Tallocate memory for string */
 
-			DEBUG(10, ("** tallocating memory\n"));
-
-			data->notify_data.data.string = (uint16 *)
-				talloc_zero(ps->mem_ctx, x * 2);
+			data->notify_data.data.string = (uint16 *)prs_alloc_mem(ps, x * 2);
 			if (!data->notify_data.data.string) 
 				return False;
 
@@ -421,6 +431,7 @@ BOOL smb_io_notify_info_data_strings(char *desc,SPOOL_NOTIFY_INFO_DATA *data,
 /*******************************************************************
 reads or writes an NOTIFY INFO structure.
 ********************************************************************/  
+
 static BOOL smb_io_notify_info(char *desc, SPOOL_NOTIFY_INFO *info, prs_struct *ps, int depth)
 {
 	int i;
@@ -454,16 +465,16 @@ static BOOL smb_io_notify_info(char *desc, SPOOL_NOTIFY_INFO *info, prs_struct *
 	return True;
 }
 
-
 /*******************************************************************
 ********************************************************************/  
+
 static BOOL spool_io_user_level_1(char *desc, SPOOL_USER_1 *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "");
 	depth++;
 
 	/* reading */
-	if (ps->io)
+	if (UNMARSHALLING(ps))
 		ZERO_STRUCTP(q_u);
 
 	if (!prs_align(ps))
@@ -495,6 +506,7 @@ static BOOL spool_io_user_level_1(char *desc, SPOOL_USER_1 *q_u, prs_struct *ps,
 
 /*******************************************************************
 ********************************************************************/  
+
 static BOOL spool_io_user_level(char *desc, SPOOL_USER_CTR *q_u, prs_struct *ps, int depth)
 {
 	if (q_u==NULL)
@@ -526,6 +538,7 @@ static BOOL spool_io_user_level(char *desc, SPOOL_USER_CTR *q_u, prs_struct *ps,
  * read or write a DEVICEMODE struct.
  * on reading allocate memory for the private member
  ********************************************************************/
+
 static BOOL spoolss_io_devmode(char *desc, prs_struct *ps, int depth, DEVICEMODE *devmode)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_devmode");
@@ -615,7 +628,7 @@ static BOOL spoolss_io_devmode(char *desc, prs_struct *ps, int depth, DEVICEMODE
 
 	if (devmode->driverextra!=0) {
 		if (UNMARSHALLING(ps)) {
-			devmode->private=(uint8 *)malloc(devmode->driverextra*sizeof(uint8));
+			devmode->private=(uint8 *)prs_alloc_mem(ps, devmode->driverextra*sizeof(uint8));
 			if(devmode->private == NULL)
 				return False;
 			DEBUG(7,("spoolss_io_devmode: allocated memory [%d] for private\n",devmode->driverextra)); 
@@ -629,18 +642,10 @@ static BOOL spoolss_io_devmode(char *desc, prs_struct *ps, int depth, DEVICEMODE
 	return True;
 }
 
-void free_spoolss_devmode(DEVICEMODE *devmode)
-{
-	if (devmode == NULL)
-		return;
-
-	safe_free(devmode->private);
-	safe_free(devmode);
-}
-
 /*******************************************************************
  Read or write a DEVICEMODE container
 ********************************************************************/  
+
 static BOOL spoolss_io_devmode_cont(char *desc, DEVMODE_CTR *dm_c, prs_struct *ps, int depth)
 {
 	if (dm_c==NULL)
@@ -668,10 +673,9 @@ static BOOL spoolss_io_devmode_cont(char *desc, DEVMODE_CTR *dm_c, prs_struct *p
 	/* so we have a DEVICEMODE to follow */		
 	if (UNMARSHALLING(ps)) {
 		DEBUG(9,("Allocating memory for spoolss_io_devmode\n"));
-		dm_c->devmode=(DEVICEMODE *)malloc(sizeof(DEVICEMODE));
+		dm_c->devmode=(DEVICEMODE *)prs_alloc_mem(ps,sizeof(DEVICEMODE));
 		if(dm_c->devmode == NULL)
 			return False;
-		ZERO_STRUCTP(dm_c->devmode);
 	}
 	
 	/* this is bad code, shouldn't be there */
@@ -686,6 +690,7 @@ static BOOL spoolss_io_devmode_cont(char *desc, DEVMODE_CTR *dm_c, prs_struct *p
 
 /*******************************************************************
 ********************************************************************/  
+
 static BOOL spoolss_io_printer_default(char *desc, PRINTER_DEFAULT *pd, prs_struct *ps, int depth)
 {
 	if (pd==NULL)
@@ -715,6 +720,7 @@ static BOOL spoolss_io_printer_default(char *desc, PRINTER_DEFAULT *pd, prs_stru
 /*******************************************************************
  * init a structure.
  ********************************************************************/
+
 BOOL make_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u,
 		const fstring printername, 
 		const fstring datatype, 
@@ -754,7 +760,8 @@ BOOL make_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u,
 /*******************************************************************
  * init a structure.
  ********************************************************************/
-BOOL make_spoolss_q_addprinterex(SPOOL_Q_ADDPRINTEREX *q_u, const char *srv_name,
+
+BOOL make_spoolss_q_addprinterex(TALLOC_CTX *ctx, SPOOL_Q_ADDPRINTEREX *q_u, const char *srv_name,
 				 const char* clientname, const char* user_name,
 				 uint32 level, PRINTER_INFO_2 *info)
 {
@@ -771,7 +778,7 @@ BOOL make_spoolss_q_addprinterex(SPOOL_Q_ADDPRINTEREX *q_u, const char *srv_name
 	{
 		case 2:
 			/* init q_u->info.info2 from *info */
-			if (!make_spool_printer_info_2( &q_u->info.info_2, info))
+			if (!make_spool_printer_info_2( ctx, &q_u->info.info_2, info))
 			{
 				DEBUG(0,("make_spoolss_q_addprinterex: Unable to fill SPOOL_Q_ADDPRINTEREX struct!\n"));
 				return False;
@@ -800,60 +807,25 @@ BOOL make_spoolss_q_addprinterex(SPOOL_Q_ADDPRINTEREX *q_u, const char *srv_name
 	
 	return True;
 }
-
-/*******************************************************************
- free dynamically allocated members
- ********************************************************************/
-void free_spoolss_q_addprinterex(SPOOL_Q_ADDPRINTEREX *q_u)
-{
-	switch (q_u->info.level)
-	{
-	case 1:
-		if (q_u->info.info_1 != NULL)
-		{
-			free(q_u->info.info_1);
-			q_u->info.info_1 = NULL;
-		}
-			break;
-	case 2:
-		if (q_u->info.info_2 != NULL)
-		{
-			free(q_u->info.info_2);
-			q_u->info.info_2 = NULL;
-		}
-		break;
-	case 3:
-		if (q_u->info.info_3 != NULL)
-		{
-			free(q_u->info.info_3);
-			q_u->info.info_3 = NULL;
-		}
-		break;
-	}
-
-	return;
-	
-}
 	
 /*******************************************************************
 create a SPOOL_PRINTER_INFO_2 stuct from a PRINTER_INFO_2 struct
 *******************************************************************/
-BOOL make_spool_printer_info_2(SPOOL_PRINTER_INFO_LEVEL_2 **spool_info2, 
+
+BOOL make_spool_printer_info_2(TALLOC_CTX *ctx, SPOOL_PRINTER_INFO_LEVEL_2 **spool_info2, 
 			       PRINTER_INFO_2 *info)
 {
 
 	SPOOL_PRINTER_INFO_LEVEL_2 *inf;
 
 	/* allocate the necessary memory */
-	inf = (SPOOL_PRINTER_INFO_LEVEL_2*)malloc(sizeof(SPOOL_PRINTER_INFO_LEVEL_2));
+	inf = (SPOOL_PRINTER_INFO_LEVEL_2*)talloc_zero(ctx,sizeof(SPOOL_PRINTER_INFO_LEVEL_2));
 	if (spool_info2 == NULL)
 	{
-		DEBUG(0,("make_spool_printer_info_2: Unable to malloc SPOOL_PRINTER_INFO_LEVEL_2 sruct!\n"));
+		DEBUG(0,("make_spool_printer_info_2: Unable to allocate SPOOL_PRINTER_INFO_LEVEL_2 sruct!\n"));
 		return False;
 	}
 	
-	ZERO_STRUCTP(inf);
-	
 	inf->servername_ptr 	= (info->servername.buffer!=NULL)?1:0;
 	inf->printername_ptr 	= (info->printername.buffer!=NULL)?1:0;
 	inf->sharename_ptr 	= (info->sharename.buffer!=NULL)?1:0;
@@ -897,6 +869,7 @@ BOOL make_spool_printer_info_2(SPOOL_PRINTER_INFO_LEVEL_2 **spool_info2,
  * read a structure.
  * called from spoolss_q_open_printer_ex (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_open_printer_ex(char *desc, SPOOL_Q_OPEN_PRINTER_EX *q_u, prs_struct *ps, int depth)
 {
 	if (q_u == NULL)
@@ -927,16 +900,12 @@ BOOL spoolss_io_q_open_printer_ex(char *desc, SPOOL_Q_OPEN_PRINTER_EX *q_u, prs_
 	return True;
 }
 
-void free_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u)
-{
-	free_spoolss_devmode(q_u->printer_default.devmode_cont.devmode);
-}
-
 /*******************************************************************
  * write a structure.
  * called from static spoolss_r_open_printer_ex (srv_spoolss.c)
  * called from spoolss_open_printer_ex (cli_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_open_printer_ex(char *desc, SPOOL_R_OPEN_PRINTER_EX *r_u, prs_struct *ps, int depth)
 {
 	if (r_u == NULL) return False;
@@ -959,6 +928,7 @@ BOOL spoolss_io_r_open_printer_ex(char *desc, SPOOL_R_OPEN_PRINTER_EX *r_u, prs_
 /*******************************************************************
  * make a structure.
  ********************************************************************/
+
 BOOL make_spoolss_q_getprinterdata(SPOOL_Q_GETPRINTERDATA *q_u,
                                 const POLICY_HND *handle,
                                 UNISTR2 *valuename, uint32 size)
@@ -974,11 +944,11 @@ BOOL make_spoolss_q_getprinterdata(SPOOL_Q_GETPRINTERDATA *q_u,
         return True;
 }
 
-
 /*******************************************************************
  * read a structure.
  * called from spoolss_q_getprinterdata (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_getprinterdata(char *desc, SPOOL_Q_GETPRINTERDATA *q_u, prs_struct *ps, int depth)
 {
 	if (q_u == NULL)
@@ -989,15 +959,15 @@ BOOL spoolss_io_q_getprinterdata(char *desc, SPOOL_Q_GETPRINTERDATA *q_u, prs_st
 
 	if (!prs_align(ps))
 		return False;
-	if (!smb_io_pol_hnd("printer handle",&(q_u->handle),ps,depth))
+	if (!smb_io_pol_hnd("printer handle",&q_u->handle,ps,depth))
 		return False;
 	if (!prs_align(ps))
 		return False;
-	if (!smb_io_unistr2("valuename", &(q_u->valuename),True,ps,depth))
+	if (!smb_io_unistr2("valuename", &q_u->valuename,True,ps,depth))
 		return False;
 	if (!prs_align(ps))
 		return False;
-	if (!prs_uint32("size", ps, depth, &(q_u->size)))
+	if (!prs_uint32("size", ps, depth, &q_u->size))
 		return False;
 
 	return True;
@@ -1007,6 +977,7 @@ BOOL spoolss_io_q_getprinterdata(char *desc, SPOOL_Q_GETPRINTERDATA *q_u, prs_st
  * read a structure.
  * called from spoolss_q_deleteprinterdata (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_deleteprinterdata(char *desc, SPOOL_Q_DELETEPRINTERDATA *q_u, prs_struct *ps, int depth)
 {
 	if (q_u == NULL)
@@ -1017,11 +988,11 @@ BOOL spoolss_io_q_deleteprinterdata(char *desc, SPOOL_Q_DELETEPRINTERDATA *q_u,
 
 	if (!prs_align(ps))
 		return False;
-	if (!smb_io_pol_hnd("printer handle",&(q_u->handle),ps,depth))
+	if (!smb_io_pol_hnd("printer handle",&q_u->handle,ps,depth))
 		return False;
 	if (!prs_align(ps))
 		return False;
-	if (!smb_io_unistr2("valuename", &(q_u->valuename),True,ps,depth))
+	if (!smb_io_unistr2("valuename", &q_u->valuename,True,ps,depth))
 		return False;
 
 	return True;
@@ -1031,6 +1002,7 @@ BOOL spoolss_io_q_deleteprinterdata(char *desc, SPOOL_Q_DELETEPRINTERDATA *q_u,
  * write a structure.
  * called from spoolss_r_deleteprinterdata (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_deleteprinterdata(char *desc, SPOOL_R_DELETEPRINTERDATA *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_deleteprinterdata");
@@ -1045,6 +1017,7 @@ BOOL spoolss_io_r_deleteprinterdata(char *desc, SPOOL_R_DELETEPRINTERDATA *r_u,
  * write a structure.
  * called from spoolss_r_getprinterdata (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_getprinterdata(char *desc, SPOOL_R_GETPRINTERDATA *r_u, prs_struct *ps, int depth)
 {
 	if (r_u == NULL)
@@ -1077,13 +1050,14 @@ BOOL spoolss_io_r_getprinterdata(char *desc, SPOOL_R_GETPRINTERDATA *r_u, prs_st
 /*******************************************************************
  * make a structure.
  ********************************************************************/
+
 BOOL make_spoolss_q_closeprinter(SPOOL_Q_CLOSEPRINTER *q_u, POLICY_HND *hnd)
 {
 	if (q_u == NULL) return False;
 
 	DEBUG(5,("make_spoolss_q_closeprinter\n"));
 
-	memcpy(&(q_u->handle), hnd, sizeof(q_u->handle));
+	memcpy(&q_u->handle, hnd, sizeof(q_u->handle));
 
 	return True;
 }
@@ -1093,6 +1067,7 @@ BOOL make_spoolss_q_closeprinter(SPOOL_Q_CLOSEPRINTER *q_u, POLICY_HND *hnd)
  * called from static spoolss_q_abortprinter (srv_spoolss.c)
  * called from spoolss_abortprinter (cli_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_abortprinter(char *desc, SPOOL_Q_ABORTPRINTER *q_u, prs_struct *ps, int depth)
 {
 	if (q_u == NULL) return False;
@@ -1113,6 +1088,7 @@ BOOL spoolss_io_q_abortprinter(char *desc, SPOOL_Q_ABORTPRINTER *q_u, prs_struct
  * write a structure.
  * called from spoolss_r_abortprinter (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_abortprinter(char *desc, SPOOL_R_ABORTPRINTER *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_abortprinter");
@@ -1128,6 +1104,7 @@ BOOL spoolss_io_r_abortprinter(char *desc, SPOOL_R_ABORTPRINTER *r_u, prs_struct
  * called from static spoolss_q_deleteprinter (srv_spoolss.c)
  * called from spoolss_deleteprinter (cli_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_deleteprinter(char *desc, SPOOL_Q_DELETEPRINTER *q_u, prs_struct *ps, int depth)
 {
 	if (q_u == NULL) return False;
@@ -1149,6 +1126,7 @@ BOOL spoolss_io_q_deleteprinter(char *desc, SPOOL_Q_DELETEPRINTER *q_u, prs_stru
  * called from static spoolss_r_deleteprinter (srv_spoolss.c)
  * called from spoolss_deleteprinter (cli_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_deleteprinter(char *desc, SPOOL_R_DELETEPRINTER *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_deleteprinter");
@@ -1165,12 +1143,12 @@ BOOL spoolss_io_r_deleteprinter(char *desc, SPOOL_R_DELETEPRINTER *r_u, prs_stru
 	return True;
 }
 
-
 /*******************************************************************
  * read a structure.
  * called from static spoolss_q_closeprinter (srv_spoolss.c)
  * called from spoolss_closeprinter (cli_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_closeprinter(char *desc, SPOOL_Q_CLOSEPRINTER *q_u, prs_struct *ps, int depth)
 {
 	if (q_u == NULL) return False;
@@ -1192,6 +1170,7 @@ BOOL spoolss_io_q_closeprinter(char *desc, SPOOL_Q_CLOSEPRINTER *q_u, prs_struct
  * called from static spoolss_r_closeprinter (srv_spoolss.c)
  * called from spoolss_closeprinter (cli_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_closeprinter(char *desc, SPOOL_R_CLOSEPRINTER *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_closeprinter");
@@ -1212,6 +1191,7 @@ BOOL spoolss_io_r_closeprinter(char *desc, SPOOL_R_CLOSEPRINTER *r_u, prs_struct
  * read a structure.
  * called from spoolss_q_startdocprinter (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_startdocprinter(char *desc, SPOOL_Q_STARTDOCPRINTER *q_u, prs_struct *ps, int depth)
 {
 	if (q_u == NULL) return False;
@@ -1222,10 +1202,10 @@ BOOL spoolss_io_q_startdocprinter(char *desc, SPOOL_Q_STARTDOCPRINTER *q_u, prs_
 	if(!prs_align(ps))
 		return False;
 
-	if(!smb_io_pol_hnd("printer handle",&(q_u->handle),ps,depth))
+	if(!smb_io_pol_hnd("printer handle",&q_u->handle,ps,depth))
 		return False;
 	
-	if(!smb_io_doc_info_container("",&(q_u->doc_info_container), ps, depth))
+	if(!smb_io_doc_info_container("",&q_u->doc_info_container, ps, depth))
 		return False;
 
 	return True;
@@ -1235,6 +1215,7 @@ BOOL spoolss_io_q_startdocprinter(char *desc, SPOOL_Q_STARTDOCPRINTER *q_u, prs_
  * write a structure.
  * called from spoolss_r_startdocprinter (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_startdocprinter(char *desc, SPOOL_R_STARTDOCPRINTER *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_startdocprinter");
@@ -1251,6 +1232,7 @@ BOOL spoolss_io_r_startdocprinter(char *desc, SPOOL_R_STARTDOCPRINTER *r_u, prs_
  * read a structure.
  * called from spoolss_q_enddocprinter (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_enddocprinter(char *desc, SPOOL_Q_ENDDOCPRINTER *q_u, prs_struct *ps, int depth)
 {
 	if (q_u == NULL) return False;
@@ -1271,6 +1253,7 @@ BOOL spoolss_io_q_enddocprinter(char *desc, SPOOL_Q_ENDDOCPRINTER *q_u, prs_stru
  * write a structure.
  * called from spoolss_r_enddocprinter (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_enddocprinter(char *desc, SPOOL_R_ENDDOCPRINTER *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_enddocprinter");
@@ -1285,6 +1268,7 @@ BOOL spoolss_io_r_enddocprinter(char *desc, SPOOL_R_ENDDOCPRINTER *r_u, prs_stru
  * read a structure.
  * called from spoolss_q_startpageprinter (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_startpageprinter(char *desc, SPOOL_Q_STARTPAGEPRINTER *q_u, prs_struct *ps, int depth)
 {
 	if (q_u == NULL) return False;
@@ -1305,6 +1289,7 @@ BOOL spoolss_io_q_startpageprinter(char *desc, SPOOL_Q_STARTPAGEPRINTER *q_u, pr
  * write a structure.
  * called from spoolss_r_startpageprinter (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_startpageprinter(char *desc, SPOOL_R_STARTPAGEPRINTER *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_startpageprinter");
@@ -1319,6 +1304,7 @@ BOOL spoolss_io_r_startpageprinter(char *desc, SPOOL_R_STARTPAGEPRINTER *r_u, pr
  * read a structure.
  * called from spoolss_q_endpageprinter (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_endpageprinter(char *desc, SPOOL_Q_ENDPAGEPRINTER *q_u, prs_struct *ps, int depth)
 {
 	if (q_u == NULL) return False;
@@ -1339,6 +1325,7 @@ BOOL spoolss_io_q_endpageprinter(char *desc, SPOOL_Q_ENDPAGEPRINTER *q_u, prs_st
  * write a structure.
  * called from spoolss_r_endpageprinter (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_endpageprinter(char *desc, SPOOL_R_ENDPAGEPRINTER *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_endpageprinter");
@@ -1353,6 +1340,7 @@ BOOL spoolss_io_r_endpageprinter(char *desc, SPOOL_R_ENDPAGEPRINTER *r_u, prs_st
  * read a structure.
  * called from spoolss_q_writeprinter (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_writeprinter(char *desc, SPOOL_Q_WRITEPRINTER *q_u, prs_struct *ps, int depth)
 {
 	if (q_u == NULL) return False;
@@ -1370,7 +1358,8 @@ BOOL spoolss_io_q_writeprinter(char *desc, SPOOL_Q_WRITEPRINTER *q_u, prs_struct
 	
 	if (q_u->buffer_size!=0)
 	{
-		q_u->buffer=(uint8 *)malloc(q_u->buffer_size*sizeof(uint8));
+		if (UNMARSHALLING(ps))
+			q_u->buffer=(uint8 *)prs_alloc_mem(ps,q_u->buffer_size*sizeof(uint8));
 		if(q_u->buffer == NULL)
 			return False;	
 		if(!prs_uint8s(True, "buffer", ps, depth, q_u->buffer, q_u->buffer_size))
@@ -1388,6 +1377,7 @@ BOOL spoolss_io_q_writeprinter(char *desc, SPOOL_Q_WRITEPRINTER *q_u, prs_struct
  * write a structure.
  * called from spoolss_r_writeprinter (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_writeprinter(char *desc, SPOOL_R_WRITEPRINTER *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_writeprinter");
@@ -1404,6 +1394,7 @@ BOOL spoolss_io_r_writeprinter(char *desc, SPOOL_R_WRITEPRINTER *r_u, prs_struct
  * read a structure.
  * called from spoolss_q_rffpcnex (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_rffpcnex(char *desc, SPOOL_Q_RFFPCNEX *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_rffpcnex");
@@ -1435,7 +1426,7 @@ BOOL spoolss_io_q_rffpcnex(char *desc, SPOOL_Q_RFFPCNEX *q_u, prs_struct *ps, in
 	if (q_u->option_ptr!=0) {
 	
 		if (UNMARSHALLING(ps))
-			if((q_u->option=(SPOOL_NOTIFY_OPTION *)malloc(sizeof(SPOOL_NOTIFY_OPTION))) == NULL)
+			if((q_u->option=(SPOOL_NOTIFY_OPTION *)prs_alloc_mem(ps,sizeof(SPOOL_NOTIFY_OPTION))) == NULL)
 				return False;
 	
 		if(!smb_io_notify_option("notify option", q_u->option, ps, depth))
@@ -1449,6 +1440,7 @@ BOOL spoolss_io_q_rffpcnex(char *desc, SPOOL_Q_RFFPCNEX *q_u, prs_struct *ps, in
  * write a structure.
  * called from spoolss_r_rffpcnex (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_rffpcnex(char *desc, SPOOL_R_RFFPCNEX *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_rffpcnex");
@@ -1464,6 +1456,7 @@ BOOL spoolss_io_r_rffpcnex(char *desc, SPOOL_R_RFFPCNEX *r_u, prs_struct *ps, in
  * read a structure.
  * called from spoolss_q_rfnpcnex (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_rfnpcnex(char *desc, SPOOL_Q_RFNPCNEX *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_rfnpcnex");
@@ -1484,7 +1477,7 @@ BOOL spoolss_io_q_rfnpcnex(char *desc, SPOOL_Q_RFNPCNEX *q_u, prs_struct *ps, in
 	if (q_u->option_ptr!=0) {
 	
 		if (UNMARSHALLING(ps))
-			if((q_u->option=(SPOOL_NOTIFY_OPTION *)malloc(sizeof(SPOOL_NOTIFY_OPTION))) == NULL)
+			if((q_u->option=(SPOOL_NOTIFY_OPTION *)prs_alloc_mem(ps,sizeof(SPOOL_NOTIFY_OPTION))) == NULL)
 				return False;
 	
 		if(!smb_io_notify_option("notify option", q_u->option, ps, depth))
@@ -1498,6 +1491,7 @@ BOOL spoolss_io_q_rfnpcnex(char *desc, SPOOL_Q_RFNPCNEX *q_u, prs_struct *ps, in
  * write a structure.
  * called from spoolss_r_rfnpcnex (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_rfnpcnex(char *desc, SPOOL_R_RFNPCNEX *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_rfnpcnex");
@@ -1523,6 +1517,7 @@ BOOL spoolss_io_r_rfnpcnex(char *desc, SPOOL_R_RFNPCNEX *r_u, prs_struct *ps, in
 /*******************************************************************
  * return the length of a uint16 (obvious, but the code is clean)
  ********************************************************************/
+
 static uint32 size_of_uint16(uint16 *value)
 {
 	return (sizeof(*value));
@@ -1531,13 +1526,16 @@ static uint32 size_of_uint16(uint16 *value)
 /*******************************************************************
  * return the length of a uint32 (obvious, but the code is clean)
  ********************************************************************/
+
 static uint32 size_of_uint32(uint32 *value)
 {
 	return (sizeof(*value));
 }
+
 /*******************************************************************
  * return the length of a NTTIME (obvious, but the code is clean)
  ********************************************************************/
+
 static uint32 size_of_nttime(NTTIME *value)
 {
 	return (sizeof(*value));
@@ -1548,6 +1546,7 @@ static uint32 size_of_nttime(NTTIME *value)
  * - the leading zero
  * - the relative pointer size
  ********************************************************************/
+
 static uint32 size_of_relative_string(UNISTR *string)
 {
 	uint32 size=0;
@@ -1565,6 +1564,7 @@ static uint32 size_of_relative_string(UNISTR *string)
 /*******************************************************************
  * return the length of a uint32 (obvious, but the code is clean)
  ********************************************************************/
+
 static uint32 size_of_device_mode(DEVICEMODE *devmode)
 {
 	if (devmode==NULL)
@@ -1576,6 +1576,7 @@ static uint32 size_of_device_mode(DEVICEMODE *devmode)
 /*******************************************************************
  * return the length of a uint32 (obvious, but the code is clean)
  ********************************************************************/
+
 static uint32 size_of_systemtime(SYSTEMTIME *systime)
 {
 	if (systime==NULL)
@@ -1588,6 +1589,7 @@ static uint32 size_of_systemtime(SYSTEMTIME *systime)
  * write a UNICODE string.
  * used by all the RPC structs passing a buffer
  ********************************************************************/
+
 static BOOL spoolss_smb_io_unistr(char *desc, UNISTR *uni, prs_struct *ps, int depth)
 {
 	if (uni == NULL)
@@ -1609,7 +1611,6 @@ static BOOL spoolss_smb_io_unistr(char *desc, UNISTR *uni, prs_struct *ps, int d
 	return True;
 }
 
-
 /*******************************************************************
  * write a UNICODE string and its relative pointer.
  * used by all the RPC structs passing a buffer
@@ -1629,6 +1630,7 @@ static BOOL spoolss_smb_io_unistr(char *desc, UNISTR *uni, prs_struct *ps, int d
  * first get in touch with me: jfm@samba.org
  *
  ********************************************************************/
+
 static BOOL new_smb_io_relstr(char *desc, NEW_BUFFER *buffer, int depth, UNISTR *string)
 {
 	prs_struct *ps=&buffer->prs;
@@ -1677,11 +1679,11 @@ static BOOL new_smb_io_relstr(char *desc, NEW_BUFFER *buffer, int depth, UNISTR
 	return True;
 }
 
-
 /*******************************************************************
  * write a array of UNICODE strings and its relative pointer.
  * used by 2 RPC structs
  ********************************************************************/
+
 static BOOL new_smb_io_relarraystr(char *desc, NEW_BUFFER *buffer, int depth, uint16 **string)
 {
 	UNISTR chaine;
@@ -1709,6 +1711,8 @@ static BOOL new_smb_io_relarraystr(char *desc, NEW_BUFFER *buffer, int depth, ui
 			while (*q!=0)
 				q++;
 
+			/* Yes this should be malloc not talloc. Don't change. */
+
 			chaine.buffer = malloc((q-p+1)*sizeof(uint16));
 			if (chaine.buffer == NULL)
 				return False;
@@ -1740,13 +1744,17 @@ static BOOL new_smb_io_relarraystr(char *desc, NEW_BUFFER *buffer, int depth, ui
 		/* write its offset */
 		if (!prs_uint32("offset", ps, depth, &relative_offset))
 			return False;
-	}
-	else {
+
+	} else {
+
+		/* UNMARSHALLING */
+
 		uint32 old_offset;
 		uint16 *chaine2=NULL;
 		int l_chaine=0;
 		int l_chaine2=0;
-		
+		size_t realloc_size = 0;
+
 		*string=NULL;
 				
 		/* read the offset */
@@ -1768,7 +1776,11 @@ static BOOL new_smb_io_relarraystr(char *desc, NEW_BUFFER *buffer, int depth, ui
 			   an extra NULL for termination */
 			if (l_chaine > 0)
 			{
-				if((chaine2=(uint16 *)Realloc(chaine2, (l_chaine2+l_chaine+2)*sizeof(uint16))) == NULL)
+				realloc_size = (l_chaine2+l_chaine+2)*sizeof(uint16);
+
+				/* Yes this should be realloc - it's freed below. JRA */
+
+				if((chaine2=(uint16 *)Realloc(chaine2, realloc_size)) == NULL)
 					return False;
 				memcpy(chaine2+l_chaine2, chaine.buffer, (l_chaine+1)*sizeof(uint16));
 				l_chaine2+=l_chaine+1;
@@ -1781,8 +1793,9 @@ static BOOL new_smb_io_relarraystr(char *desc, NEW_BUFFER *buffer, int depth, ui
 		if (chaine2)
 		{
 			chaine2[l_chaine2] = '\0';
+			*string=(uint16 *)talloc_memdup(prs_get_mem_context(ps),chaine2,realloc_size);
+			free(chaine2);
 		}
-		*string=chaine2;
 
 		if(!prs_set_offset(ps, old_offset))
 			return False;
@@ -1790,12 +1803,11 @@ static BOOL new_smb_io_relarraystr(char *desc, NEW_BUFFER *buffer, int depth, ui
 	return True;
 }
 
-
 /*******************************************************************
  Parse a DEVMODE structure and its relative pointer.
 ********************************************************************/
-static BOOL new_smb_io_relsecdesc(char *desc, NEW_BUFFER *buffer, int depth,
-		SEC_DESC **secdesc)
+
+static BOOL new_smb_io_relsecdesc(char *desc, NEW_BUFFER *buffer, int depth, SEC_DESC **secdesc)
 {
 	prs_struct *ps= &buffer->prs;
 
@@ -1855,6 +1867,7 @@ static BOOL new_smb_io_relsecdesc(char *desc, NEW_BUFFER *buffer, int depth,
 /*******************************************************************
  Parse a DEVMODE structure and its relative pointer.
 ********************************************************************/
+
 static BOOL new_smb_io_reldevmode(char *desc, NEW_BUFFER *buffer, int depth, DEVICEMODE **devmode)
 {
 	prs_struct *ps=&buffer->prs;
@@ -1904,7 +1917,7 @@ static BOOL new_smb_io_reldevmode(char *desc, NEW_BUFFER *buffer, int depth, DEV
 			return False;
 
 		/* read the string */
-		if((*devmode=(DEVICEMODE *)malloc(sizeof(DEVICEMODE))) == NULL)
+		if((*devmode=(DEVICEMODE *)prs_alloc_mem(ps,sizeof(DEVICEMODE))) == NULL)
 			return False;
 		if (!spoolss_io_devmode(desc, ps, depth, *devmode))
 			return False;
@@ -1915,10 +1928,10 @@ static BOOL new_smb_io_reldevmode(char *desc, NEW_BUFFER *buffer, int depth, DEV
 	return True;
 }
 
-
 /*******************************************************************
  Parse a PRINTER_INFO_0 structure.
 ********************************************************************/  
+
 BOOL new_smb_io_printer_info_0(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_0 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2019,6 +2032,7 @@ BOOL new_smb_io_printer_info_0(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_0 *i
 /*******************************************************************
  Parse a PRINTER_INFO_1 structure.
 ********************************************************************/  
+
 BOOL new_smb_io_printer_info_1(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_1 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2043,6 +2057,7 @@ BOOL new_smb_io_printer_info_1(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_1 *i
 /*******************************************************************
  Parse a PRINTER_INFO_2 structure.
 ********************************************************************/  
+
 BOOL new_smb_io_printer_info_2(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_2 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2113,6 +2128,7 @@ BOOL new_smb_io_printer_info_2(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_2 *i
 /*******************************************************************
  Parse a PRINTER_INFO_3 structure.
 ********************************************************************/  
+
 BOOL new_smb_io_printer_info_3(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_3 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2133,6 +2149,7 @@ BOOL new_smb_io_printer_info_3(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_3 *i
 /*******************************************************************
  Parse a PORT_INFO_1 structure.
 ********************************************************************/  
+
 BOOL new_smb_io_port_info_1(char *desc, NEW_BUFFER *buffer, PORT_INFO_1 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2151,6 +2168,7 @@ BOOL new_smb_io_port_info_1(char *desc, NEW_BUFFER *buffer, PORT_INFO_1 *info, i
 /*******************************************************************
  Parse a PORT_INFO_2 structure.
 ********************************************************************/  
+
 BOOL new_smb_io_port_info_2(char *desc, NEW_BUFFER *buffer, PORT_INFO_2 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2177,6 +2195,7 @@ BOOL new_smb_io_port_info_2(char *desc, NEW_BUFFER *buffer, PORT_INFO_2 *info, i
 /*******************************************************************
  Parse a DRIVER_INFO_1 structure.
 ********************************************************************/
+
 BOOL new_smb_io_printer_driver_info_1(char *desc, NEW_BUFFER *buffer, DRIVER_INFO_1 *info, int depth) 
 {
 	prs_struct *ps=&buffer->prs;
@@ -2192,10 +2211,10 @@ BOOL new_smb_io_printer_driver_info_1(char *desc, NEW_BUFFER *buffer, DRIVER_INF
 	return True;
 }
 
-
 /*******************************************************************
  Parse a DRIVER_INFO_2 structure.
 ********************************************************************/
+
 BOOL new_smb_io_printer_driver_info_2(char *desc, NEW_BUFFER *buffer, DRIVER_INFO_2 *info, int depth) 
 {
 	prs_struct *ps=&buffer->prs;
@@ -2221,10 +2240,10 @@ BOOL new_smb_io_printer_driver_info_2(char *desc, NEW_BUFFER *buffer, DRIVER_INF
 	return True;
 }
 
-
 /*******************************************************************
  Parse a DRIVER_INFO_3 structure.
 ********************************************************************/
+
 BOOL new_smb_io_printer_driver_info_3(char *desc, NEW_BUFFER *buffer, DRIVER_INFO_3 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2263,6 +2282,7 @@ BOOL new_smb_io_printer_driver_info_3(char *desc, NEW_BUFFER *buffer, DRIVER_INF
 /*******************************************************************
  Parse a DRIVER_INFO_6 structure.
 ********************************************************************/
+
 BOOL new_smb_io_printer_driver_info_6(char *desc, NEW_BUFFER *buffer, DRIVER_INFO_6 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2324,10 +2344,10 @@ BOOL new_smb_io_printer_driver_info_6(char *desc, NEW_BUFFER *buffer, DRIVER_INF
 	return True;
 }
 
-
 /*******************************************************************
  Parse a JOB_INFO_1 structure.
 ********************************************************************/  
+
 BOOL new_smb_io_job_info_1(char *desc, NEW_BUFFER *buffer, JOB_INFO_1 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2370,6 +2390,7 @@ BOOL new_smb_io_job_info_1(char *desc, NEW_BUFFER *buffer, JOB_INFO_1 *info, int
 /*******************************************************************
  Parse a JOB_INFO_2 structure.
 ********************************************************************/  
+
 BOOL new_smb_io_job_info_2(char *desc, NEW_BUFFER *buffer, JOB_INFO_2 *info, int depth)
 {	
 	uint pipo=0;
@@ -2436,6 +2457,7 @@ BOOL new_smb_io_job_info_2(char *desc, NEW_BUFFER *buffer, JOB_INFO_2 *info, int
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL new_smb_io_form_1(char *desc, NEW_BUFFER *buffer, FORM_1 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2470,14 +2492,20 @@ BOOL new_smb_io_form_1(char *desc, NEW_BUFFER *buffer, FORM_1 *info, int depth)
 /*******************************************************************
  Read/write a BUFFER struct.
 ********************************************************************/  
-static BOOL new_spoolss_io_buffer(char *desc, prs_struct *ps, int depth, NEW_BUFFER *buffer)
+
+static BOOL new_spoolss_io_buffer(char *desc, prs_struct *ps, int depth, NEW_BUFFER **pp_buffer)
 {
-	if (buffer == NULL)
-		return False;
+	NEW_BUFFER *buffer = *pp_buffer;
 
 	prs_debug(ps, depth, desc, "new_spoolss_io_buffer");
 	depth++;
 	
+	if (UNMARSHALLING(ps))
+		buffer = *pp_buffer = (NEW_BUFFER *)prs_alloc_mem(ps, sizeof(NEW_BUFFER));
+
+	if (buffer == NULL)
+		return False;
+
 	if (!prs_uint32("ptr", ps, depth, &buffer->ptr))
 		return False;
 	
@@ -2527,7 +2555,10 @@ static BOOL new_spoolss_io_buffer(char *desc, prs_struct *ps, int depth, NEW_BUF
 
 /*******************************************************************
  move a BUFFER from the query to the reply.
+ As the data pointers in NEW_BUFFER are malloc'ed, not talloc'ed,
+ this is ok. This is an OPTIMIZATION and is not strictly neccessary.
 ********************************************************************/  
+
 void new_spoolss_move_buffer(NEW_BUFFER *src, NEW_BUFFER **dest)
 {
 	prs_switch_type(&src->prs, MARSHALL);
@@ -2539,53 +2570,18 @@ void new_spoolss_move_buffer(NEW_BUFFER *src, NEW_BUFFER **dest)
 }
 
 /*******************************************************************
- create a BUFFER struct.
-********************************************************************/  
-BOOL new_spoolss_allocate_buffer(NEW_BUFFER **buffer)
-{
-	if (buffer==NULL)
-		return False;
-		
-	if((*buffer=(NEW_BUFFER *)malloc(sizeof(NEW_BUFFER))) == NULL) {
-		DEBUG(0,("new_spoolss_allocate_buffer: malloc fail for size %u.\n",
-				(unsigned int)sizeof(NEW_BUFFER) ));
-		return False;
-	}
-	
-	(*buffer)->ptr=0x0;
-	(*buffer)->size=0;
-	(*buffer)->string_at_end=0;	
-	return True;
-}
-
-/*******************************************************************
- Destroy a BUFFER struct.
-********************************************************************/  
-void new_spoolss_free_buffer(NEW_BUFFER *buffer)
-{
-	if (buffer==NULL)
-		return;
-		
-	prs_mem_free(&buffer->prs);
-	buffer->ptr=0x0;
-	buffer->size=0;
-	buffer->string_at_end=0;
-	
-	free(buffer);
-}
-
-/*******************************************************************
  Get the size of a BUFFER struct.
 ********************************************************************/  
+
 uint32 new_get_buffer_size(NEW_BUFFER *buffer)
 {
 	return (buffer->size);
 }
 
-
 /*******************************************************************
  Parse a DRIVER_DIRECTORY_1 structure.
 ********************************************************************/  
+
 BOOL new_smb_io_driverdir_1(char *desc, NEW_BUFFER *buffer, DRIVER_DIRECTORY_1 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2604,6 +2600,7 @@ BOOL new_smb_io_driverdir_1(char *desc, NEW_BUFFER *buffer, DRIVER_DIRECTORY_1 *
 /*******************************************************************
  Parse a PORT_INFO_1 structure.
 ********************************************************************/  
+
 BOOL new_smb_io_port_1(char *desc, NEW_BUFFER *buffer, PORT_INFO_1 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2622,6 +2619,7 @@ BOOL new_smb_io_port_1(char *desc, NEW_BUFFER *buffer, PORT_INFO_1 *info, int de
 /*******************************************************************
  Parse a PORT_INFO_2 structure.
 ********************************************************************/  
+
 BOOL new_smb_io_port_2(char *desc, NEW_BUFFER *buffer, PORT_INFO_2 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2645,9 +2643,9 @@ BOOL new_smb_io_port_2(char *desc, NEW_BUFFER *buffer, PORT_INFO_2 *info, int de
 	return True;
 }
 
-
 /*******************************************************************
 ********************************************************************/  
+
 BOOL smb_io_printprocessor_info_1(char *desc, NEW_BUFFER *buffer, PRINTPROCESSOR_1 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2665,6 +2663,7 @@ BOOL smb_io_printprocessor_info_1(char *desc, NEW_BUFFER *buffer, PRINTPROCESSOR
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL smb_io_printprocdatatype_info_1(char *desc, NEW_BUFFER *buffer, PRINTPROCDATATYPE_1 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2682,6 +2681,7 @@ BOOL smb_io_printprocdatatype_info_1(char *desc, NEW_BUFFER *buffer, PRINTPROCDA
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL smb_io_printmonitor_info_1(char *desc, NEW_BUFFER *buffer, PRINTMONITOR_1 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2699,6 +2699,7 @@ BOOL smb_io_printmonitor_info_1(char *desc, NEW_BUFFER *buffer, PRINTMONITOR_1 *
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL smb_io_printmonitor_info_2(char *desc, NEW_BUFFER *buffer, PRINTMONITOR_2 *info, int depth)
 {
 	prs_struct *ps=&buffer->prs;
@@ -2721,6 +2722,7 @@ BOOL smb_io_printmonitor_info_2(char *desc, NEW_BUFFER *buffer, PRINTMONITOR_2 *
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/  
+
 uint32 spoolss_size_printer_info_0(PRINTER_INFO_0 *info)
 {
 	int size=0;
@@ -2778,6 +2780,7 @@ uint32 spoolss_size_printer_info_0(PRINTER_INFO_0 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/  
+
 uint32 spoolss_size_printer_info_1(PRINTER_INFO_1 *info)
 {
 	int size=0;
@@ -2793,6 +2796,7 @@ uint32 spoolss_size_printer_info_1(PRINTER_INFO_1 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/
+
 uint32 spoolss_size_printer_info_2(PRINTER_INFO_2 *info)
 {
 	uint32 size=0;
@@ -2830,6 +2834,7 @@ uint32 spoolss_size_printer_info_2(PRINTER_INFO_2 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/
+
 uint32 spoolss_size_printer_info_3(PRINTER_INFO_3 *info)
 {
 	/* The 4 is for the self relative pointer.. */
@@ -2840,6 +2845,7 @@ uint32 spoolss_size_printer_info_3(PRINTER_INFO_3 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/
+
 uint32 spoolss_size_printer_driver_info_1(DRIVER_INFO_1 *info)
 {
 	int size=0;
@@ -2851,6 +2857,7 @@ uint32 spoolss_size_printer_driver_info_1(DRIVER_INFO_1 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/
+
 uint32 spoolss_size_printer_driver_info_2(DRIVER_INFO_2 *info)
 {
 	int size=0;
@@ -2867,6 +2874,7 @@ uint32 spoolss_size_printer_driver_info_2(DRIVER_INFO_2 *info)
 /*******************************************************************
 return the size required by a string array.
 ********************************************************************/
+
 uint32 spoolss_size_string_array(uint16 *string)
 {
 	uint32 i = 0;
@@ -2884,6 +2892,7 @@ uint32 spoolss_size_string_array(uint16 *string)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/
+
 uint32 spoolss_size_printer_driver_info_3(DRIVER_INFO_3 *info)
 {
 	int size=0;
@@ -2906,6 +2915,7 @@ uint32 spoolss_size_printer_driver_info_3(DRIVER_INFO_3 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/
+
 uint32 spoolss_size_printer_driver_info_6(DRIVER_INFO_6 *info)
 {
 	uint32 size=0;
@@ -2937,10 +2947,10 @@ uint32 spoolss_size_printer_driver_info_6(DRIVER_INFO_6 *info)
 	return size;
 }
 
-
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/  
+
 uint32 spoolss_size_job_info_1(JOB_INFO_1 *info)
 {
 	int size=0;
@@ -2964,6 +2974,7 @@ uint32 spoolss_size_job_info_1(JOB_INFO_1 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/  
+
 uint32 spoolss_size_job_info_2(JOB_INFO_2 *info)
 {
 	int size=0;
@@ -3000,6 +3011,7 @@ uint32 spoolss_size_job_info_2(JOB_INFO_2 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/
+
 uint32 spoolss_size_form_1(FORM_1 *info)
 {
 	int size=0;
@@ -3019,6 +3031,7 @@ uint32 spoolss_size_form_1(FORM_1 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/  
+
 uint32 spoolss_size_port_info_1(PORT_INFO_1 *info)
 {
 	int size=0;
@@ -3031,6 +3044,7 @@ uint32 spoolss_size_port_info_1(PORT_INFO_1 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/  
+
 uint32 spoolss_size_driverdir_info_1(DRIVER_DIRECTORY_1 *info)
 {
 	int size=0;
@@ -3045,6 +3059,7 @@ uint32 spoolss_size_driverdir_info_1(DRIVER_DIRECTORY_1 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/  
+
 uint32 spoolss_size_port_info_2(PORT_INFO_2 *info)
 {
 	int size=0;
@@ -3062,6 +3077,7 @@ uint32 spoolss_size_port_info_2(PORT_INFO_2 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/  
+
 uint32 spoolss_size_printprocessor_info_1(PRINTPROCESSOR_1 *info)
 {
 	int size=0;
@@ -3073,6 +3089,7 @@ uint32 spoolss_size_printprocessor_info_1(PRINTPROCESSOR_1 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/  
+
 uint32 spoolss_size_printprocdatatype_info_1(PRINTPROCDATATYPE_1 *info)
 {
 	int size=0;
@@ -3084,6 +3101,7 @@ uint32 spoolss_size_printprocdatatype_info_1(PRINTPROCDATATYPE_1 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/  
+
 uint32 spoolss_size_printmonitor_info_1(PRINTMONITOR_1 *info)
 {
 	int size=0;
@@ -3095,6 +3113,7 @@ uint32 spoolss_size_printmonitor_info_1(PRINTMONITOR_1 *info)
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/  
+
 uint32 spoolss_size_printmonitor_info_2(PRINTMONITOR_2 *info)
 {
 	int size=0;
@@ -3108,6 +3127,7 @@ uint32 spoolss_size_printmonitor_info_2(PRINTMONITOR_2 *info)
 /*******************************************************************
  * init a structure.
  ********************************************************************/
+
 BOOL make_spoolss_q_getprinterdriver2(SPOOL_Q_GETPRINTERDRIVER2 *q_u, 
 			       const POLICY_HND *hnd,
 			       const fstring architecture,
@@ -3135,6 +3155,7 @@ BOOL make_spoolss_q_getprinterdriver2(SPOOL_Q_GETPRINTERDRIVER2 *q_u,
  * read a structure.
  * called from spoolss_getprinterdriver2 (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_getprinterdriver2(char *desc, SPOOL_Q_GETPRINTERDRIVER2 *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_getprinterdriver2");
@@ -3155,7 +3176,7 @@ BOOL spoolss_io_q_getprinterdriver2(char *desc, SPOOL_Q_GETPRINTERDRIVER2 *q_u,
 	if(!prs_uint32("level", ps, depth, &q_u->level))
 		return False;
 		
-	if(!new_spoolss_io_buffer("", ps, depth, q_u->buffer))
+	if(!new_spoolss_io_buffer("", ps, depth, &q_u->buffer))
 		return False;
 
 	if(!prs_align(ps))
@@ -3176,6 +3197,7 @@ BOOL spoolss_io_q_getprinterdriver2(char *desc, SPOOL_Q_GETPRINTERDRIVER2 *q_u,
  * read a structure.
  * called from spoolss_getprinterdriver2 (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_r_getprinterdriver2(char *desc, SPOOL_R_GETPRINTERDRIVER2 *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_getprinterdriver2");
@@ -3184,7 +3206,7 @@ BOOL spoolss_io_r_getprinterdriver2(char *desc, SPOOL_R_GETPRINTERDRIVER2 *r_u,
 	if (!prs_align(ps))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3204,6 +3226,7 @@ BOOL spoolss_io_r_getprinterdriver2(char *desc, SPOOL_R_GETPRINTERDRIVER2 *r_u,
 /*******************************************************************
  * init a structure.
  ********************************************************************/
+
 BOOL make_spoolss_q_enumprinters(SPOOL_Q_ENUMPRINTERS *q_u, uint32 flags, 
 				fstring servername, uint32 level, 
 				NEW_BUFFER *buffer, uint32 offered)
@@ -3223,6 +3246,7 @@ BOOL make_spoolss_q_enumprinters(SPOOL_Q_ENUMPRINTERS *q_u, uint32 flags,
 /*******************************************************************
  * init a structure.
  ********************************************************************/
+
 BOOL make_spoolss_q_enumports(SPOOL_Q_ENUMPORTS *q_u, 
 				fstring servername, uint32 level, 
 				NEW_BUFFER *buffer, uint32 offered)
@@ -3241,6 +3265,7 @@ BOOL make_spoolss_q_enumports(SPOOL_Q_ENUMPORTS *q_u,
  * read a structure.
  * called from spoolss_enumprinters (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_enumprinters(char *desc, SPOOL_Q_ENUMPRINTERS *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_enumprinters");
@@ -3262,7 +3287,7 @@ BOOL spoolss_io_q_enumprinters(char *desc, SPOOL_Q_ENUMPRINTERS *q_u, prs_struct
 	if (!prs_uint32("level", ps, depth, &q_u->level))
 		return False;
 
-	if (!new_spoolss_io_buffer("", ps, depth, q_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &q_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3276,6 +3301,7 @@ BOOL spoolss_io_q_enumprinters(char *desc, SPOOL_Q_ENUMPRINTERS *q_u, prs_struct
 /*******************************************************************
  Parse a SPOOL_R_ENUMPRINTERS structure.
  ********************************************************************/
+
 BOOL new_spoolss_io_r_enumprinters(char *desc, SPOOL_R_ENUMPRINTERS *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "new_spoolss_io_r_enumprinters");
@@ -3284,7 +3310,7 @@ BOOL new_spoolss_io_r_enumprinters(char *desc, SPOOL_R_ENUMPRINTERS *r_u, prs_st
 	if (!prs_align(ps))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3307,6 +3333,7 @@ BOOL new_spoolss_io_r_enumprinters(char *desc, SPOOL_R_ENUMPRINTERS *r_u, prs_st
  * called from spoolss_r_enum_printers (srv_spoolss.c)
  *
  ********************************************************************/
+
 BOOL spoolss_io_r_getprinter(char *desc, SPOOL_R_GETPRINTER *r_u, prs_struct *ps, int depth)
 {	
 	prs_debug(ps, depth, desc, "spoolss_io_r_getprinter");
@@ -3315,7 +3342,7 @@ BOOL spoolss_io_r_getprinter(char *desc, SPOOL_R_GETPRINTER *r_u, prs_struct *ps
 	if (!prs_align(ps))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3334,6 +3361,7 @@ BOOL spoolss_io_r_getprinter(char *desc, SPOOL_R_GETPRINTER *r_u, prs_struct *ps
  * read a structure.
  * called from spoolss_getprinter (srv_spoolss.c)
  ********************************************************************/
+
 BOOL spoolss_io_q_getprinter(char *desc, SPOOL_Q_GETPRINTER *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_getprinter");
@@ -3347,7 +3375,7 @@ BOOL spoolss_io_q_getprinter(char *desc, SPOOL_Q_GETPRINTER *q_u, prs_struct *ps
 	if (!prs_uint32("level", ps, depth, &q_u->level))
 		return False;
 
-	if (!new_spoolss_io_buffer("", ps, depth, q_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &q_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3361,6 +3389,7 @@ BOOL spoolss_io_q_getprinter(char *desc, SPOOL_Q_GETPRINTER *q_u, prs_struct *ps
 /*******************************************************************
  * init a structure.
  ********************************************************************/
+
 BOOL make_spoolss_q_getprinter(SPOOL_Q_GETPRINTER *q_u, const POLICY_HND *hnd, uint32 level, 
 				NEW_BUFFER *buffer, uint32 offered)
 {
@@ -3379,6 +3408,7 @@ BOOL make_spoolss_q_getprinter(SPOOL_Q_GETPRINTER *q_u, const POLICY_HND *hnd, u
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_setprinter(char *desc, SPOOL_R_SETPRINTER *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "spoolss_io_r_setprinter");
@@ -3394,17 +3424,6 @@ BOOL spoolss_io_r_setprinter(char *desc, SPOOL_R_SETPRINTER *r_u, prs_struct *ps
 }
 
 /*******************************************************************
- Delete the dynamic parts of a SPOOL_Q_SETPRINTER struct.
-********************************************************************/  
-
-void free_spoolss_q_setprinter(SPOOL_Q_SETPRINTER *q_u)
-{
-	free_spool_printer_info_level(&q_u->info);
-	free_sec_desc_buf( &q_u->secdesc_ctr );
-	free_devmode( q_u->devmode_ctr.devmode );
-}
-
-/*******************************************************************
  Marshall/unmarshall a SPOOL_Q_SETPRINTER struct.
 ********************************************************************/  
 
@@ -3466,6 +3485,7 @@ BOOL spoolss_io_q_setprinter(char *desc, SPOOL_Q_SETPRINTER *q_u, prs_struct *ps
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_fcpn(char *desc, SPOOL_R_FCPN *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "spoolss_io_r_fcpn");
@@ -3482,6 +3502,7 @@ BOOL spoolss_io_r_fcpn(char *desc, SPOOL_R_FCPN *r_u, prs_struct *ps, int depth)
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_fcpn(char *desc, SPOOL_Q_FCPN *q_u, prs_struct *ps, int depth)
 {
 
@@ -3500,6 +3521,7 @@ BOOL spoolss_io_q_fcpn(char *desc, SPOOL_Q_FCPN *q_u, prs_struct *ps, int depth)
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_addjob(char *desc, SPOOL_R_ADDJOB *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "");
@@ -3508,7 +3530,7 @@ BOOL spoolss_io_r_addjob(char *desc, SPOOL_R_ADDJOB *r_u, prs_struct *ps, int de
 	if(!prs_align(ps))
 		return False;
 	
-	if(!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if(!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if(!prs_align(ps))
@@ -3525,6 +3547,7 @@ BOOL spoolss_io_r_addjob(char *desc, SPOOL_R_ADDJOB *r_u, prs_struct *ps, int de
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_addjob(char *desc, SPOOL_Q_ADDJOB *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "");
@@ -3538,7 +3561,7 @@ BOOL spoolss_io_q_addjob(char *desc, SPOOL_Q_ADDJOB *q_u, prs_struct *ps, int de
 	if(!prs_uint32("level", ps, depth, &q_u->level))
 		return False;
 	
-	if(!new_spoolss_io_buffer("", ps, depth, q_u->buffer))
+	if(!new_spoolss_io_buffer("", ps, depth, &q_u->buffer))
 		return False;
 
 	if(!prs_align(ps))
@@ -3552,6 +3575,7 @@ BOOL spoolss_io_q_addjob(char *desc, SPOOL_Q_ADDJOB *q_u, prs_struct *ps, int de
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_enumjobs(char *desc, SPOOL_R_ENUMJOBS *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "spoolss_io_r_enumjobs");
@@ -3560,7 +3584,7 @@ BOOL spoolss_io_r_enumjobs(char *desc, SPOOL_R_ENUMJOBS *r_u, prs_struct *ps, in
 	if (!prs_align(ps))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3578,9 +3602,9 @@ BOOL spoolss_io_r_enumjobs(char *desc, SPOOL_R_ENUMJOBS *r_u, prs_struct *ps, in
 	return True;		
 }
 
-
 /*******************************************************************
 ********************************************************************/  
+
 BOOL make_spoolss_q_enumjobs(SPOOL_Q_ENUMJOBS *q_u, const POLICY_HND *hnd,
 				uint32 firstjob,
 				uint32 numofjobs,
@@ -3603,6 +3627,7 @@ BOOL make_spoolss_q_enumjobs(SPOOL_Q_ENUMJOBS *q_u, const POLICY_HND *hnd,
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_enumjobs(char *desc, SPOOL_Q_ENUMJOBS *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_enumjobs");
@@ -3621,7 +3646,7 @@ BOOL spoolss_io_q_enumjobs(char *desc, SPOOL_Q_ENUMJOBS *q_u, prs_struct *ps, in
 	if (!prs_uint32("level", ps, depth, &q_u->level))
 		return False;
 
-	if (!new_spoolss_io_buffer("", ps, depth, q_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &q_u->buffer))
 		return False;	
 
 	if (!prs_uint32("offered", ps, depth, &q_u->offered))
@@ -3632,6 +3657,7 @@ BOOL spoolss_io_q_enumjobs(char *desc, SPOOL_Q_ENUMJOBS *q_u, prs_struct *ps, in
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_schedulejob(char *desc, SPOOL_R_SCHEDULEJOB *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "spoolss_io_r_schedulejob");
@@ -3648,6 +3674,7 @@ BOOL spoolss_io_r_schedulejob(char *desc, SPOOL_R_SCHEDULEJOB *r_u, prs_struct *
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_schedulejob(char *desc, SPOOL_Q_SCHEDULEJOB *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_schedulejob");
@@ -3666,6 +3693,7 @@ BOOL spoolss_io_q_schedulejob(char *desc, SPOOL_Q_SCHEDULEJOB *q_u, prs_struct *
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_setjob(char *desc, SPOOL_R_SETJOB *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "spoolss_io_r_setjob");
@@ -3682,6 +3710,7 @@ BOOL spoolss_io_r_setjob(char *desc, SPOOL_R_SETJOB *r_u, prs_struct *ps, int de
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_setjob(char *desc, SPOOL_Q_SETJOB *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_setjob");
@@ -3709,6 +3738,7 @@ BOOL spoolss_io_q_setjob(char *desc, SPOOL_Q_SETJOB *q_u, prs_struct *ps, int de
 /*******************************************************************
  Parse a SPOOL_R_ENUMPRINTERDRIVERS structure.
 ********************************************************************/  
+
 BOOL new_spoolss_io_r_enumprinterdrivers(char *desc, SPOOL_R_ENUMPRINTERDRIVERS *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "new_spoolss_io_r_enumprinterdrivers");
@@ -3717,7 +3747,7 @@ BOOL new_spoolss_io_r_enumprinterdrivers(char *desc, SPOOL_R_ENUMPRINTERDRIVERS
 	if (!prs_align(ps))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3738,6 +3768,7 @@ BOOL new_spoolss_io_r_enumprinterdrivers(char *desc, SPOOL_R_ENUMPRINTERDRIVERS
 /*******************************************************************
  * init a structure.
  ********************************************************************/
+
 BOOL make_spoolss_q_enumprinterdrivers(SPOOL_Q_ENUMPRINTERDRIVERS *q_u,
                                 const char *name,
                                 const char *environment,
@@ -3757,6 +3788,7 @@ BOOL make_spoolss_q_enumprinterdrivers(SPOOL_Q_ENUMPRINTERDRIVERS *q_u,
 /*******************************************************************
  Parse a SPOOL_Q_ENUMPRINTERDRIVERS structure.
 ********************************************************************/  
+
 BOOL spoolss_io_q_enumprinterdrivers(char *desc, SPOOL_Q_ENUMPRINTERDRIVERS *q_u, prs_struct *ps, int depth)
 {
 
@@ -3783,7 +3815,7 @@ BOOL spoolss_io_q_enumprinterdrivers(char *desc, SPOOL_Q_ENUMPRINTERDRIVERS *q_u
 	if (!prs_uint32("level", ps, depth, &q_u->level))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, q_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &q_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3797,6 +3829,7 @@ BOOL spoolss_io_q_enumprinterdrivers(char *desc, SPOOL_Q_ENUMPRINTERDRIVERS *q_u
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_enumforms(char *desc, SPOOL_Q_ENUMFORMS *q_u, prs_struct *ps, int depth)
 {
 
@@ -3810,7 +3843,7 @@ BOOL spoolss_io_q_enumforms(char *desc, SPOOL_Q_ENUMFORMS *q_u, prs_struct *ps,
 	if (!prs_uint32("level", ps, depth, &q_u->level))
 		return False;	
 	
-	if (!new_spoolss_io_buffer("", ps, depth, q_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &q_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3823,6 +3856,7 @@ BOOL spoolss_io_q_enumforms(char *desc, SPOOL_Q_ENUMFORMS *q_u, prs_struct *ps,
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL new_spoolss_io_r_enumforms(char *desc, SPOOL_R_ENUMFORMS *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "new_spoolss_io_r_enumforms");
@@ -3831,7 +3865,7 @@ BOOL new_spoolss_io_r_enumforms(char *desc, SPOOL_R_ENUMFORMS *r_u, prs_struct *
 	if (!prs_align(ps))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3851,6 +3885,7 @@ BOOL new_spoolss_io_r_enumforms(char *desc, SPOOL_R_ENUMFORMS *r_u, prs_struct *
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_getform(char *desc, SPOOL_Q_GETFORM *q_u, prs_struct *ps, int depth)
 {
 
@@ -3870,7 +3905,7 @@ BOOL spoolss_io_q_getform(char *desc, SPOOL_Q_GETFORM *q_u, prs_struct *ps, int
 	if (!prs_uint32("level", ps, depth, &q_u->level))
 		return False;	
 	
-	if (!new_spoolss_io_buffer("", ps, depth, q_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &q_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3883,6 +3918,7 @@ BOOL spoolss_io_q_getform(char *desc, SPOOL_Q_GETFORM *q_u, prs_struct *ps, int
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL new_spoolss_io_r_getform(char *desc, SPOOL_R_GETFORM *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "new_spoolss_io_r_getform");
@@ -3891,7 +3927,7 @@ BOOL new_spoolss_io_r_getform(char *desc, SPOOL_R_GETFORM *r_u, prs_struct *ps,
 	if (!prs_align(ps))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3905,9 +3941,11 @@ BOOL new_spoolss_io_r_getform(char *desc, SPOOL_R_GETFORM *r_u, prs_struct *ps,
 
 	return True;
 }
+
 /*******************************************************************
  Parse a SPOOL_R_ENUMPORTS structure.
 ********************************************************************/  
+
 BOOL new_spoolss_io_r_enumports(char *desc, SPOOL_R_ENUMPORTS *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "new_spoolss_io_r_enumports");
@@ -3916,7 +3954,7 @@ BOOL new_spoolss_io_r_enumports(char *desc, SPOOL_R_ENUMPORTS *r_u, prs_struct *
 	if (!prs_align(ps))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3936,6 +3974,7 @@ BOOL new_spoolss_io_r_enumports(char *desc, SPOOL_R_ENUMPORTS *r_u, prs_struct *
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_enumports(char *desc, SPOOL_Q_ENUMPORTS *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "");
@@ -3954,7 +3993,7 @@ BOOL spoolss_io_q_enumports(char *desc, SPOOL_Q_ENUMPORTS *q_u, prs_struct *ps,
 	if (!prs_uint32("level", ps, depth, &q_u->level))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, q_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &q_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -3968,6 +4007,7 @@ BOOL spoolss_io_q_enumports(char *desc, SPOOL_Q_ENUMPORTS *q_u, prs_struct *ps,
 /*******************************************************************
  Parse a SPOOL_PRINTER_INFO_LEVEL_1 structure.
 ********************************************************************/  
+
 BOOL spool_io_printer_info_level_1(char *desc, SPOOL_PRINTER_INFO_LEVEL_1 *il, prs_struct *ps, int depth)
 {	
 	prs_debug(ps, depth, desc, "spool_io_printer_info_level_1");
@@ -3998,6 +4038,7 @@ BOOL spool_io_printer_info_level_1(char *desc, SPOOL_PRINTER_INFO_LEVEL_1 *il, p
 /*******************************************************************
  Parse a SPOOL_PRINTER_INFO_LEVEL_3 structure.
 ********************************************************************/  
+
 BOOL spool_io_printer_info_level_3(char *desc, SPOOL_PRINTER_INFO_LEVEL_3 *il, prs_struct *ps, int depth)
 {	
 	prs_debug(ps, depth, desc, "spool_io_printer_info_level_3");
@@ -4015,6 +4056,7 @@ BOOL spool_io_printer_info_level_3(char *desc, SPOOL_PRINTER_INFO_LEVEL_3 *il, p
 /*******************************************************************
  Parse a SPOOL_PRINTER_INFO_LEVEL_2 structure.
 ********************************************************************/  
+
 BOOL spool_io_printer_info_level_2(char *desc, SPOOL_PRINTER_INFO_LEVEL_2 *il, prs_struct *ps, int depth)
 {	
 	prs_debug(ps, depth, desc, "spool_io_printer_info_level_2");
@@ -4096,6 +4138,7 @@ BOOL spool_io_printer_info_level_2(char *desc, SPOOL_PRINTER_INFO_LEVEL_2 *il, p
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spool_io_printer_info_level(char *desc, SPOOL_PRINTER_INFO_LEVEL *il, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spool_io_printer_info_level");
@@ -4128,15 +4171,11 @@ BOOL spool_io_printer_info_level(char *desc, SPOOL_PRINTER_INFO_LEVEL *il, prs_s
 		case 1:
 		{
 			if (UNMARSHALLING(ps)) {
-				if ((il->info_1=(SPOOL_PRINTER_INFO_LEVEL_1 *)malloc(sizeof(SPOOL_PRINTER_INFO_LEVEL_1))) == NULL)
+				if ((il->info_1=(SPOOL_PRINTER_INFO_LEVEL_1 *)prs_alloc_mem(ps,sizeof(SPOOL_PRINTER_INFO_LEVEL_1))) == NULL)
 					return False;
-				ZERO_STRUCTP(il->info_1);
 			}
-			if (!spool_io_printer_info_level_1("", il->info_1, ps, depth)) {
-				if (UNMARSHALLING(ps))
-					safe_free(il->info_1);
+			if (!spool_io_printer_info_level_1("", il->info_1, ps, depth))
 				return False;
-			}
 			break;		
 		}
 		/* 
@@ -4145,29 +4184,21 @@ BOOL spool_io_printer_info_level(char *desc, SPOOL_PRINTER_INFO_LEVEL *il, prs_s
 		 */	
 		case 2:
 			if (UNMARSHALLING(ps)) {
-				if ((il->info_2=(SPOOL_PRINTER_INFO_LEVEL_2 *)malloc(sizeof(SPOOL_PRINTER_INFO_LEVEL_2))) == NULL)
+				if ((il->info_2=(SPOOL_PRINTER_INFO_LEVEL_2 *)prs_alloc_mem(ps,sizeof(SPOOL_PRINTER_INFO_LEVEL_2))) == NULL)
 					return False;
-				ZERO_STRUCTP(il->info_2);
 			}
-			if (!spool_io_printer_info_level_2("", il->info_2, ps, depth)) {
-				if (UNMARSHALLING(ps))
-					safe_free(il->info_2);
+			if (!spool_io_printer_info_level_2("", il->info_2, ps, depth))
 				return False;
-			}
 			break;		
 		/* DOCUMENT ME!!! What is level 3 used for? */
 		case 3:
 		{
 			if (UNMARSHALLING(ps)) {
-				if ((il->info_3=(SPOOL_PRINTER_INFO_LEVEL_3 *)malloc(sizeof(SPOOL_PRINTER_INFO_LEVEL_3))) == NULL)
+				if ((il->info_3=(SPOOL_PRINTER_INFO_LEVEL_3 *)prs_alloc_mem(ps,sizeof(SPOOL_PRINTER_INFO_LEVEL_3))) == NULL)
 					return False;
-				ZERO_STRUCTP(il->info_3);
 			}
-			if (!spool_io_printer_info_level_3("", il->info_3, ps, depth)) {
-				if (UNMARSHALLING(ps))
-					safe_free(il->info_3);
+			if (!spool_io_printer_info_level_3("", il->info_3, ps, depth))
 				return False;
-			}
 			break;		
 		}
 	}
@@ -4177,6 +4208,7 @@ BOOL spool_io_printer_info_level(char *desc, SPOOL_PRINTER_INFO_LEVEL *il, prs_s
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_addprinterex(char *desc, SPOOL_Q_ADDPRINTEREX *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_addprinterex");
@@ -4228,6 +4260,7 @@ BOOL spoolss_io_q_addprinterex(char *desc, SPOOL_Q_ADDPRINTEREX *q_u, prs_struct
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_addprinterex(char *desc, SPOOL_R_ADDPRINTEREX *r_u, 
 			       prs_struct *ps, int depth)
 {
@@ -4245,6 +4278,7 @@ BOOL spoolss_io_r_addprinterex(char *desc, SPOOL_R_ADDPRINTEREX *r_u,
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spool_io_printer_driver_info_level_3(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u, 
                                           prs_struct *ps, int depth)
 {	
@@ -4255,10 +4289,9 @@ BOOL spool_io_printer_driver_info_level_3(char *desc, SPOOL_PRINTER_DRIVER_INFO_
 		
 	/* reading */
 	if (UNMARSHALLING(ps)) {
-		il=(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *)malloc(sizeof(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3));
+		il=(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *)prs_alloc_mem(ps,sizeof(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3));
 		if(il == NULL)
 			return False;
-		ZERO_STRUCTP(il);
 		*q_u=il;
 	}
 	else {
@@ -4320,19 +4353,10 @@ BOOL spool_io_printer_driver_info_level_3(char *desc, SPOOL_PRINTER_DRIVER_INFO_
 	return True;
 }
 
-void free_spool_printer_driver_info_level_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u)
-{
-	SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *il = *q_u;
-
-	if (il == NULL)
-		return;
-
-	safe_free(il);
-}
-
 /*******************************************************************
 parse a SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 structure
 ********************************************************************/  
+
 BOOL spool_io_printer_driver_info_level_6(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u, 
                                           prs_struct *ps, int depth)
 {	
@@ -4343,10 +4367,9 @@ BOOL spool_io_printer_driver_info_level_6(char *desc, SPOOL_PRINTER_DRIVER_INFO_
 		
 	/* reading */
 	if (UNMARSHALLING(ps)) {
-		il=(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 *)malloc(sizeof(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6));
+		il=(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 *)prs_alloc_mem(ps,sizeof(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6));
 		if(il == NULL)
 			return False;
-		ZERO_STRUCTP(il);
 		*q_u=il;
 	}
 	else {
@@ -4483,17 +4506,6 @@ BOOL spool_io_printer_driver_info_level_6(char *desc, SPOOL_PRINTER_DRIVER_INFO_
 	return True;
 }
 
-void free_spool_printer_driver_info_level_6(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u)
-{
-	SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 *il = *q_u;
-
-	if (il == NULL)
-		return;
-
-	safe_free(il);
-}
-
-
 /*******************************************************************
  convert a buffer of UNICODE strings null terminated
  the buffer is terminated by a NULL
@@ -4531,6 +4543,7 @@ static BOOL uniarray_2_dosarray(BUFFER5 *buf5, fstring **ar)
  and null terminated array 
  and size of array at beginning
 ********************************************************************/  
+
 BOOL smb_io_unibuffer(char *desc, UNISTR2 *buffer, prs_struct *ps, int depth)
 {
 	if (buffer==NULL) return False;
@@ -4549,6 +4562,7 @@ BOOL smb_io_unibuffer(char *desc, UNISTR2 *buffer, prs_struct *ps, int depth)
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL *il, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spool_io_printer_driver_info_level");
@@ -4580,25 +4594,11 @@ BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LE
 	return True;
 }
 
-void free_spool_printer_driver_info_level(SPOOL_PRINTER_DRIVER_INFO_LEVEL *il)
-{
-	if (il->ptr==0)
-		return;
-
-	switch (il->level) {
-		case 3:
-			free_spool_printer_driver_info_level_3(&il->info_3);
-			break;
-		case 6:
-			free_spool_printer_driver_info_level_6(&il->info_6);
-			break;
-	}
-}
-
 /*******************************************************************
  init a SPOOL_Q_ADDPRINTERDRIVER struct
  ******************************************************************/
-BOOL make_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u, 
+
+BOOL make_spoolss_q_addprinterdriver(TALLOC_CTX *ctx, SPOOL_Q_ADDPRINTERDRIVER *q_u, 
 				     const char* srv_name, uint32 level, 
 				     PRINTER_DRIVER_CTR *info)
 {
@@ -4617,8 +4617,8 @@ BOOL make_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u,
 		   WinNT and Win2k */
 		case 3 :
 			q_u->info.info_3=(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3*)
-				          malloc(sizeof(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3));
-			make_spool_driver_info_3(q_u->info.info_3, info->info3);
+				          talloc_zero(ctx, sizeof(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3));
+			make_spool_driver_info_3(ctx,q_u->info.info_3, info->info3);
 			break;
 		
 		/* info level 6 is supported by WinME and Win2k */
@@ -4635,7 +4635,7 @@ info level [%d]\n", level));
 	return True;
 }
 
-BOOL make_spool_driver_info_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *spool_drv_info,
+BOOL make_spool_driver_info_3(TALLOC_CTX *ctx, SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *spool_drv_info,
 			      DRIVER_INFO_3 *info3)
 {
 	uint32		len = 0;
@@ -4685,29 +4685,21 @@ BOOL make_spool_driver_info_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *spool_drv_info,
 	}
 	spool_drv_info->dependentfiles_ptr = (info3->dependentfiles!=NULL)?1:0;
 	spool_drv_info->dependentfilessize = len;
-	make_spool_buffer5(&spool_drv_info->dependentfiles, len, info3->dependentfiles);
+	if(!make_spool_buffer5(ctx, &spool_drv_info->dependentfiles, len, info3->dependentfiles))
+		return False;
 	
 	return True;
 }	     
 
-void free_spool_driver_info_3 (SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *info)
-{
-	if (info != NULL)
-	{
-		free_spool_buffer5(&info->dependentfiles);
-	}
-	
-	return;
-}
-
 /*******************************************************************
  make a BUFFER5 struct from a uint16*
  ******************************************************************/
-BOOL make_spool_buffer5(BUFFER5 *buf5, uint32 len, uint16 *src)
+
+BOOL make_spool_buffer5(TALLOC_CTX *ctx, BUFFER5 *buf5, uint32 len, uint16 *src)
 {
 
 	buf5->buf_len = len;
-	if((buf5->buffer=(uint16*)malloc(sizeof(uint16)*len)) == NULL)
+	if((buf5->buffer=(uint16*)talloc(ctx, sizeof(uint16)*len)) == NULL)
 	{
 		DEBUG(0,("make_spool_buffer5: Unable to malloc memory for buffer!\n"));
 		return False;
@@ -4718,21 +4710,10 @@ BOOL make_spool_buffer5(BUFFER5 *buf5, uint32 len, uint16 *src)
 	return True;
 }
 
-
-void free_spool_buffer5(BUFFER5 *buf)
-{
-	if (buf != NULL)
-	{
-		free(buf->buffer);
-		buf->buffer = NULL;
-	}
-	
-	return;
-}
-
 /*******************************************************************
  fill in the prs_struct for a ADDPRINTERDRIVER request PDU
  ********************************************************************/  
+
 BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_addprinterdriver");
@@ -4758,16 +4739,8 @@ BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, pr
 }
 
 /*******************************************************************
- Free the dynamic parts of a printer driver.
 ********************************************************************/  
 
-void free_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u)
-{
-	free_spool_printer_driver_info_level(&q_u->info);
-}
-
-/*******************************************************************
-********************************************************************/  
 BOOL spoolss_io_r_addprinterdriver(char *desc, SPOOL_R_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_addprinterdriver");
@@ -4779,9 +4752,9 @@ BOOL spoolss_io_r_addprinterdriver(char *desc, SPOOL_R_ADDPRINTERDRIVER *q_u, pr
 	return True;
 }
 
-
 /*******************************************************************
 ********************************************************************/  
+
 BOOL uni_2_asc_printer_driver_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *uni,
                                 NT_PRINTER_DRIVER_INFO_LEVEL_3 **asc)
 {
@@ -4924,6 +4897,7 @@ BOOL uni_2_asc_printer_info_2(const SPOOL_PRINTER_INFO_LEVEL_2 *uni,
 /*******************************************************************
  * init a structure.
  ********************************************************************/
+
 BOOL make_spoolss_q_getprinterdriverdir(SPOOL_Q_GETPRINTERDRIVERDIR *q_u,
                                 fstring servername, fstring env_name, uint32 level,
                                 NEW_BUFFER *buffer, uint32 offered)
@@ -4931,17 +4905,17 @@ BOOL make_spoolss_q_getprinterdriverdir(SPOOL_Q_GETPRINTERDRIVERDIR *q_u,
 	init_buf_unistr2(&q_u->name, &q_u->name_ptr, servername);
 	init_buf_unistr2(&q_u->environment, &q_u->environment_ptr, env_name);
 
-        q_u->level=level;
-        q_u->buffer=buffer;
-        q_u->offered=offered;
+	q_u->level=level;
+	q_u->buffer=buffer;
+	q_u->offered=offered;
 
-        return True;
+	return True;
 }
 
-
 /*******************************************************************
  Parse a SPOOL_Q_GETPRINTERDRIVERDIR structure.
 ********************************************************************/  
+
 BOOL spoolss_io_q_getprinterdriverdir(char *desc, SPOOL_Q_GETPRINTERDRIVERDIR *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_getprinterdriverdir");
@@ -4968,7 +4942,7 @@ BOOL spoolss_io_q_getprinterdriverdir(char *desc, SPOOL_Q_GETPRINTERDRIVERDIR *q
 	if(!prs_uint32("level", ps, depth, &q_u->level))
 		return False;
 		
-	if(!new_spoolss_io_buffer("", ps, depth, q_u->buffer))
+	if(!new_spoolss_io_buffer("", ps, depth, &q_u->buffer))
 		return False;
 		
 	if(!prs_align(ps))
@@ -4983,6 +4957,7 @@ BOOL spoolss_io_q_getprinterdriverdir(char *desc, SPOOL_Q_GETPRINTERDRIVERDIR *q
 /*******************************************************************
  Parse a SPOOL_R_GETPRINTERDRIVERDIR structure.
 ********************************************************************/  
+
 BOOL spoolss_io_r_getprinterdriverdir(char *desc, SPOOL_R_GETPRINTERDRIVERDIR *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "spoolss_io_r_getprinterdriverdir");
@@ -4991,7 +4966,7 @@ BOOL spoolss_io_r_getprinterdriverdir(char *desc, SPOOL_R_GETPRINTERDRIVERDIR *r
 	if (!prs_align(ps))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -5008,6 +4983,7 @@ BOOL spoolss_io_r_getprinterdriverdir(char *desc, SPOOL_R_GETPRINTERDRIVERDIR *r
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_enumprintprocessors(char *desc, SPOOL_R_ENUMPRINTPROCESSORS *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "spoolss_io_r_enumprintprocessors");
@@ -5016,7 +4992,7 @@ BOOL spoolss_io_r_enumprintprocessors(char *desc, SPOOL_R_ENUMPRINTPROCESSORS *r
 	if (!prs_align(ps))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -5036,6 +5012,7 @@ BOOL spoolss_io_r_enumprintprocessors(char *desc, SPOOL_R_ENUMPRINTPROCESSORS *r
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_enumprintprocessors(char *desc, SPOOL_Q_ENUMPRINTPROCESSORS *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_enumprintprocessors");
@@ -5063,7 +5040,7 @@ BOOL spoolss_io_q_enumprintprocessors(char *desc, SPOOL_Q_ENUMPRINTPROCESSORS *q
 	if (!prs_uint32("level", ps, depth, &q_u->level))
 		return False;
 		
-	if(!new_spoolss_io_buffer("", ps, depth, q_u->buffer))
+	if(!new_spoolss_io_buffer("", ps, depth, &q_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -5077,6 +5054,7 @@ BOOL spoolss_io_q_enumprintprocessors(char *desc, SPOOL_Q_ENUMPRINTPROCESSORS *q
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_enumprintprocdatatypes(char *desc, SPOOL_R_ENUMPRINTPROCDATATYPES *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "spoolss_io_r_enumprintprocdatatypes");
@@ -5085,7 +5063,7 @@ BOOL spoolss_io_r_enumprintprocdatatypes(char *desc, SPOOL_R_ENUMPRINTPROCDATATY
 	if (!prs_align(ps))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -5105,6 +5083,7 @@ BOOL spoolss_io_r_enumprintprocdatatypes(char *desc, SPOOL_R_ENUMPRINTPROCDATATY
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_enumprintprocdatatypes(char *desc, SPOOL_Q_ENUMPRINTPROCDATATYPES *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_enumprintprocdatatypes");
@@ -5132,7 +5111,7 @@ BOOL spoolss_io_q_enumprintprocdatatypes(char *desc, SPOOL_Q_ENUMPRINTPROCDATATY
 	if (!prs_uint32("level", ps, depth, &q_u->level))
 		return False;
 		
-	if(!new_spoolss_io_buffer("buffer", ps, depth, q_u->buffer))
+	if(!new_spoolss_io_buffer("buffer", ps, depth, &q_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -5147,6 +5126,7 @@ BOOL spoolss_io_q_enumprintprocdatatypes(char *desc, SPOOL_Q_ENUMPRINTPROCDATATY
 /*******************************************************************
  Parse a SPOOL_Q_ENUMPRINTMONITORS structure.
 ********************************************************************/  
+
 BOOL spoolss_io_q_enumprintmonitors(char *desc, SPOOL_Q_ENUMPRINTMONITORS *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_enumprintmonitors");
@@ -5166,7 +5146,7 @@ BOOL spoolss_io_q_enumprintmonitors(char *desc, SPOOL_Q_ENUMPRINTMONITORS *q_u,
 	if (!prs_uint32("level", ps, depth, &q_u->level))
 		return False;
 		
-	if(!new_spoolss_io_buffer("", ps, depth, q_u->buffer))
+	if(!new_spoolss_io_buffer("", ps, depth, &q_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -5180,6 +5160,7 @@ BOOL spoolss_io_q_enumprintmonitors(char *desc, SPOOL_Q_ENUMPRINTMONITORS *q_u,
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_enumprintmonitors(char *desc, SPOOL_R_ENUMPRINTMONITORS *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "spoolss_io_r_enumprintmonitors");
@@ -5188,7 +5169,7 @@ BOOL spoolss_io_r_enumprintmonitors(char *desc, SPOOL_R_ENUMPRINTMONITORS *r_u,
 	if (!prs_align(ps))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -5208,6 +5189,7 @@ BOOL spoolss_io_r_enumprintmonitors(char *desc, SPOOL_R_ENUMPRINTMONITORS *r_u,
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_enumprinterdata(char *desc, SPOOL_R_ENUMPRINTERDATA *r_u, prs_struct *ps, int depth)
 {	
 	prs_debug(ps, depth, desc, "spoolss_io_r_enumprinterdata");
@@ -5253,6 +5235,7 @@ BOOL spoolss_io_r_enumprinterdata(char *desc, SPOOL_R_ENUMPRINTERDATA *r_u, prs_
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_enumprinterdata(char *desc, SPOOL_Q_ENUMPRINTERDATA *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_enumprinterdata");
@@ -5274,6 +5257,7 @@ BOOL spoolss_io_q_enumprinterdata(char *desc, SPOOL_Q_ENUMPRINTERDATA *q_u, prs_
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL make_spoolss_q_enumprinterdata(SPOOL_Q_ENUMPRINTERDATA *q_u,
 		const POLICY_HND *hnd,
 		uint32 idx, uint32 valuelen, uint32 datalen)
@@ -5288,6 +5272,7 @@ BOOL make_spoolss_q_enumprinterdata(SPOOL_Q_ENUMPRINTERDATA *q_u,
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_setprinterdata(char *desc, SPOOL_Q_SETPRINTERDATA *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_setprinterdata");
@@ -5315,7 +5300,8 @@ BOOL spoolss_io_q_setprinterdata(char *desc, SPOOL_Q_SETPRINTERDATA *q_u, prs_st
 		case 0x3:
 		case 0x4:
 		case 0x7:
-			q_u->data=(uint8 *)malloc(q_u->max_len * sizeof(uint8));
+			if (UNMARSHALLING(ps))
+				q_u->data=(uint8 *)prs_alloc_mem(ps, q_u->max_len * sizeof(uint8));
 			if(q_u->data == NULL)
 				return False;
 			if(!prs_uint8s(False,"data", ps, depth, q_u->data, q_u->max_len))
@@ -5331,13 +5317,9 @@ BOOL spoolss_io_q_setprinterdata(char *desc, SPOOL_Q_SETPRINTERDATA *q_u, prs_st
 	return True;
 }
 
-void free_spoolss_q_setprinterdata(SPOOL_Q_SETPRINTERDATA *q_u)
-{
-	safe_free(q_u->data);
-}
-
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_setprinterdata(char *desc, SPOOL_R_SETPRINTERDATA *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_setprinterdata");
@@ -5351,9 +5333,9 @@ BOOL spoolss_io_r_setprinterdata(char *desc, SPOOL_R_SETPRINTERDATA *r_u, prs_st
 	return True;
 }
 
-
 /*******************************************************************
 ********************************************************************/  
+
 BOOL convert_specific_param(NT_PRINTER_PARAM **param, const UNISTR2 *value,
 				uint32 type, const uint8 *data, uint32 len)
 {
@@ -5389,6 +5371,7 @@ BOOL convert_specific_param(NT_PRINTER_PARAM **param, const UNISTR2 *value,
 
 /*******************************************************************
 ********************************************************************/  
+
 static BOOL spoolss_io_addform(char *desc, FORM *f, uint32 ptr, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_addform");
@@ -5424,6 +5407,7 @@ static BOOL spoolss_io_addform(char *desc, FORM *f, uint32 ptr, prs_struct *ps,
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_deleteform(char *desc, SPOOL_Q_DELETEFORM *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_deleteform");
@@ -5441,6 +5425,7 @@ BOOL spoolss_io_q_deleteform(char *desc, SPOOL_Q_DELETEFORM *q_u, prs_struct *ps
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_deleteform(char *desc, SPOOL_R_DELETEFORM *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_deleteform");
@@ -5456,6 +5441,7 @@ BOOL spoolss_io_r_deleteform(char *desc, SPOOL_R_DELETEFORM *r_u, prs_struct *ps
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_addform(char *desc, SPOOL_Q_ADDFORM *q_u, prs_struct *ps, int depth)
 {
 	uint32 useless_ptr=0;
@@ -5484,6 +5470,7 @@ BOOL spoolss_io_q_addform(char *desc, SPOOL_Q_ADDFORM *q_u, prs_struct *ps, int
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_addform(char *desc, SPOOL_R_ADDFORM *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_addform");
@@ -5499,6 +5486,7 @@ BOOL spoolss_io_r_addform(char *desc, SPOOL_R_ADDFORM *r_u, prs_struct *ps, int
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_q_setform(char *desc, SPOOL_Q_SETFORM *q_u, prs_struct *ps, int depth)
 {
 	uint32 useless_ptr=0;
@@ -5533,6 +5521,7 @@ BOOL spoolss_io_q_setform(char *desc, SPOOL_Q_SETFORM *q_u, prs_struct *ps, int
 
 /*******************************************************************
 ********************************************************************/  
+
 BOOL spoolss_io_r_setform(char *desc, SPOOL_R_SETFORM *r_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_r_setform");
@@ -5549,6 +5538,7 @@ BOOL spoolss_io_r_setform(char *desc, SPOOL_R_SETFORM *r_u, prs_struct *ps, int
 /*******************************************************************
  Parse a SPOOL_R_GETJOB structure.
 ********************************************************************/  
+
 BOOL spoolss_io_r_getjob(char *desc, SPOOL_R_GETJOB *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "spoolss_io_r_getjob");
@@ -5557,7 +5547,7 @@ BOOL spoolss_io_r_getjob(char *desc, SPOOL_R_GETJOB *r_u, prs_struct *ps, int de
 	if (!prs_align(ps))
 		return False;
 		
-	if (!new_spoolss_io_buffer("", ps, depth, r_u->buffer))
+	if (!new_spoolss_io_buffer("", ps, depth, &r_u->buffer))
 		return False;
 
 	if (!prs_align(ps))
@@ -5575,6 +5565,7 @@ BOOL spoolss_io_r_getjob(char *desc, SPOOL_R_GETJOB *r_u, prs_struct *ps, int de
 /*******************************************************************
  Parse a SPOOL_Q_GETJOB structure.
 ********************************************************************/  
+
 BOOL spoolss_io_q_getjob(char *desc, SPOOL_Q_GETJOB *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "");
@@ -5590,7 +5581,7 @@ BOOL spoolss_io_q_getjob(char *desc, SPOOL_Q_GETJOB *q_u, prs_struct *ps, int de
 	if(!prs_uint32("level", ps, depth, &q_u->level))
 		return False;
 	
-	if(!new_spoolss_io_buffer("", ps, depth, q_u->buffer))
+	if(!new_spoolss_io_buffer("", ps, depth, &q_u->buffer))
 		return False;
 
 	if(!prs_align(ps))
@@ -5620,8 +5611,6 @@ void free_printer_info_2(PRINTER_INFO_2 *printer)
 	if (printer!=NULL) {
 		free_devmode(printer->devmode);
 		printer->devmode = NULL;
-		if (printer->secdesc != NULL)
-			free_sec_desc(&printer->secdesc);
 		safe_free(printer);
 	}
 }
@@ -5629,51 +5618,10 @@ void free_printer_info_2(PRINTER_INFO_2 *printer)
 void free_printer_info_3(PRINTER_INFO_3 *printer)
 {
 	if (printer!=NULL) {
-		if (printer->secdesc != NULL)
-			free_sec_desc(&printer->secdesc);
 		safe_free(printer);
 	}
 }
 
-void free_spool_printer_info_1(SPOOL_PRINTER_INFO_LEVEL_1 *printer)
-{
-	safe_free(printer);
-}
-
-void free_spool_printer_info_2(SPOOL_PRINTER_INFO_LEVEL_2 *printer)
-{
-	if (printer!=NULL) {
-		if (printer->secdesc != NULL)
-			free_sec_desc_buf(&printer->secdesc);
-		safe_free(printer);
-	}
-}
-
-void free_spool_printer_info_3(SPOOL_PRINTER_INFO_LEVEL_3 *printer)
-{
-	safe_free(printer);
-}
-
-void free_spool_printer_info_level(SPOOL_PRINTER_INFO_LEVEL *pil)
-{
-	if (pil == NULL)
-		return;
-
-	switch (pil->level) {
-		case 1:
-			free_spool_printer_info_1(pil->info_1);
-			break;
-		case 2:
-			free_spool_printer_info_2(pil->info_2);
-			break;
-		case 3:
-			free_spool_printer_info_3(pil->info_3);
-			break;
-		default:
-			break;
-	}
-}
-
 static PRINTER_INFO_2 *prt2_dup(const PRINTER_INFO_2* from)
 {
 	PRINTER_INFO_2 *copy = (PRINTER_INFO_2 *)malloc(sizeof(PRINTER_INFO_2));
@@ -5797,6 +5745,7 @@ JOB_INFO_2 *add_job2_to_array(uint32 *len, JOB_INFO_2 ***array,
 /*******************************************************************
  * init a structure.
  ********************************************************************/
+
 BOOL make_spoolss_q_replyopenprinter(SPOOL_Q_REPLYOPENPRINTER *q_u, 
 			       const fstring string, uint32 printer, uint32 type)
 {      
@@ -5817,6 +5766,7 @@ BOOL make_spoolss_q_replyopenprinter(SPOOL_Q_REPLYOPENPRINTER *q_u,
 /*******************************************************************
  Parse a SPOOL_Q_REPLYOPENPRINTER structure.
 ********************************************************************/  
+
 BOOL spoolss_io_q_replyopenprinter(char *desc, SPOOL_Q_REPLYOPENPRINTER *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_replyopenprinter");
@@ -5847,6 +5797,7 @@ BOOL spoolss_io_q_replyopenprinter(char *desc, SPOOL_Q_REPLYOPENPRINTER *q_u, pr
 /*******************************************************************
  Parse a SPOOL_R_REPLYOPENPRINTER structure.
 ********************************************************************/  
+
 BOOL spoolss_io_r_replyopenprinter(char *desc, SPOOL_R_REPLYOPENPRINTER *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "spoolss_io_r_replyopenprinter");
@@ -5867,6 +5818,7 @@ BOOL spoolss_io_r_replyopenprinter(char *desc, SPOOL_R_REPLYOPENPRINTER *r_u, pr
 /*******************************************************************
  * init a structure.
  ********************************************************************/
+
 BOOL make_spoolss_q_reply_closeprinter(SPOOL_Q_REPLYCLOSEPRINTER *q_u, POLICY_HND *hnd)
 {      
 	if (q_u == NULL)
@@ -5880,6 +5832,7 @@ BOOL make_spoolss_q_reply_closeprinter(SPOOL_Q_REPLYCLOSEPRINTER *q_u, POLICY_HN
 /*******************************************************************
  Parse a SPOOL_Q_REPLYCLOSEPRINTER structure.
 ********************************************************************/  
+
 BOOL spoolss_io_q_replycloseprinter(char *desc, SPOOL_Q_REPLYCLOSEPRINTER *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_replycloseprinter");
@@ -5897,6 +5850,7 @@ BOOL spoolss_io_q_replycloseprinter(char *desc, SPOOL_Q_REPLYCLOSEPRINTER *q_u,
 /*******************************************************************
  Parse a SPOOL_R_REPLYCLOSEPRINTER structure.
 ********************************************************************/  
+
 BOOL spoolss_io_r_replycloseprinter(char *desc, SPOOL_R_REPLYCLOSEPRINTER *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "spoolss_io_r_replycloseprinter");
@@ -5917,6 +5871,7 @@ BOOL spoolss_io_r_replycloseprinter(char *desc, SPOOL_R_REPLYCLOSEPRINTER *r_u,
 /*******************************************************************
  * init a structure.
  ********************************************************************/
+
 BOOL make_spoolss_q_reply_rrpcn(SPOOL_Q_REPLY_RRPCN *q_u, POLICY_HND *hnd,
 			        uint32 change_low, uint32 change_high)
 {      
@@ -5943,6 +5898,7 @@ BOOL make_spoolss_q_reply_rrpcn(SPOOL_Q_REPLY_RRPCN *q_u, POLICY_HND *hnd,
 /*******************************************************************
  Parse a SPOOL_Q_REPLY_RRPCN structure.
 ********************************************************************/  
+
 BOOL spoolss_io_q_reply_rrpcn(char *desc, SPOOL_Q_REPLY_RRPCN *q_u, prs_struct *ps, int depth)
 {
 	prs_debug(ps, depth, desc, "spoolss_io_q_reply_rrpcn");
@@ -5979,6 +5935,7 @@ BOOL spoolss_io_q_reply_rrpcn(char *desc, SPOOL_Q_REPLY_RRPCN *q_u, prs_struct *
 /*******************************************************************
  Parse a SPOOL_R_REPLY_RRPCN structure.
 ********************************************************************/  
+
 BOOL spoolss_io_r_reply_rrpcn(char *desc, SPOOL_R_REPLY_RRPCN *r_u, prs_struct *ps, int depth)
 {		
 	prs_debug(ps, depth, desc, "spoolss_io_r_replycloseprinter");
diff --git a/source3/rpc_server/srv_spoolss.c b/source3/rpc_server/srv_spoolss.c
index 8c06f16290..cd490d1944 100755
--- a/source3/rpc_server/srv_spoolss.c
+++ b/source3/rpc_server/srv_spoolss.c
@@ -53,9 +53,6 @@ static BOOL api_spoolss_open_printer_ex(pipes_struct *p)
 	                                       q_u.user_switch, q_u.user_ctr,
 	                                       &r_u.handle);
 
-	/* we _really_ need to switch to talloc() */
-	free_spoolss_q_open_printer_ex(&q_u);
-
 	if (!spoolss_io_r_open_printer_ex("",&r_u,rdata,0)){
 		DEBUG(0,("spoolss_io_r_open_printer_ex: unable to marshall SPOOL_R_OPEN_PRINTER_EX.\n"));
 		return False;
@@ -85,7 +82,7 @@ static BOOL api_spoolss_getprinterdata(pipes_struct *p)
 		return False;
 	}
 	
-	r_u.status = _spoolss_getprinterdata( &q_u.handle, &q_u.valuename,
+	r_u.status = _spoolss_getprinterdata( p, &q_u.handle, &q_u.valuename,
 	                                      q_u.size, &r_u.type, &r_u.size,
 	                                      &r_u.data, &r_u.needed);
 
@@ -94,8 +91,6 @@ static BOOL api_spoolss_getprinterdata(pipes_struct *p)
 		return False;
 	}
 
-	safe_free(r_u.data);
-
 	return True;
 }
 
@@ -277,9 +272,7 @@ static BOOL api_spoolss_rfnpcnex(pipes_struct *p)
 	}
 
 	r_u.status = _spoolss_rfnpcnex(&q_u.handle, q_u.change,
-	                               q_u.option, data->mem_ctx, &r_u.info);
-
-	safe_free(q_u.option);
+	                               q_u.option, p->mem_ctx, &r_u.info);
 
 	/* we always have a NOTIFY_INFO struct */
 	r_u.info_ptr=0x1;
@@ -289,8 +282,6 @@ static BOOL api_spoolss_rfnpcnex(pipes_struct *p)
 		return False;
 	}
 
-	safe_free(r_u.info.data);
-
 	return True;
 }
 
@@ -310,9 +301,6 @@ static BOOL api_spoolss_enumprinters(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumprinters("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprinters: unable to unmarshall SPOOL_Q_ENUMPRINTERS.\n"));
 		return False;
@@ -327,12 +315,9 @@ static BOOL api_spoolss_enumprinters(pipes_struct *p)
 
 	if (!new_spoolss_io_r_enumprinters("", &r_u, rdata, 0)) {
 		DEBUG(0,("new_spoolss_io_r_enumprinters: unable to marshall SPOOL_R_ENUMPRINTERS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -351,9 +336,6 @@ static BOOL api_spoolss_getprinter(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_getprinter("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getprinter: unable to unmarshall SPOOL_Q_GETPRINTER.\n"));
 		return False;
@@ -368,11 +350,9 @@ static BOOL api_spoolss_getprinter(pipes_struct *p)
 
 	if(!spoolss_io_r_getprinter("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_getprinter: unable to marshall SPOOL_R_GETPRINTER.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
 	return True;
 }
 
@@ -392,9 +372,6 @@ static BOOL api_spoolss_getprinterdriver2(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_getprinterdriver2("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getprinterdriver2: unable to unmarshall SPOOL_Q_GETPRINTERDRIVER2.\n"));
 		return False;
@@ -410,11 +387,9 @@ static BOOL api_spoolss_getprinterdriver2(pipes_struct *p)
 	
 	if(!spoolss_io_r_getprinterdriver2("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_getprinterdriver2: unable to marshall SPOOL_R_GETPRINTERDRIVER2.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 	
-	new_spoolss_free_buffer(q_u.buffer);
 	return True;
 }
 
@@ -560,7 +535,6 @@ static BOOL api_spoolss_writeprinter(pipes_struct *p)
 	                                   q_u.buffer,
 	                                   &q_u.buffer_size2);
 	r_u.buffer_written = q_u.buffer_size2;
-	safe_free(q_u.buffer);
 
 	if(!spoolss_io_r_writeprinter("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_writeprinter: unable to marshall SPOOL_R_WRITEPRINTER.\n"));
@@ -594,13 +568,9 @@ static BOOL api_spoolss_setprinter(pipes_struct *p)
 	
 	if(!spoolss_io_r_setprinter("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_setprinter: unable to marshall SPOOL_R_SETPRINTER.\n"));
-		free_spoolss_q_setprinter(&q_u);
 		return False;
 	}
 
-	/* Free anything allocated in the unparse. */
-	free_spoolss_q_setprinter(&q_u);
-
 	return True;
 }
 
@@ -644,9 +614,6 @@ static BOOL api_spoolss_addjob(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_addjob("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_addjob: unable to unmarshall SPOOL_Q_ADDJOB.\n"));
 		return False;
@@ -660,12 +627,9 @@ static BOOL api_spoolss_addjob(pipes_struct *p)
 		
 	if(!spoolss_io_r_addjob("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_addjob: unable to marshall SPOOL_R_ADDJOB.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;		
 }
 
@@ -682,9 +646,6 @@ static BOOL api_spoolss_enumjobs(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumjobs("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumjobs: unable to unmarshall SPOOL_Q_ENUMJOBS.\n"));
 		return False;
@@ -699,12 +660,9 @@ static BOOL api_spoolss_enumjobs(pipes_struct *p)
 
 	if (!spoolss_io_r_enumjobs("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_enumjobs: unable to marshall SPOOL_R_ENUMJOBS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -777,9 +735,6 @@ static BOOL api_spoolss_enumprinterdrivers(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumprinterdrivers("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprinterdrivers: unable to unmarshall SPOOL_Q_ENUMPRINTERDRIVERS.\n"));
 		return False;
@@ -794,12 +749,9 @@ static BOOL api_spoolss_enumprinterdrivers(pipes_struct *p)
 
 	if (!new_spoolss_io_r_enumprinterdrivers("",&r_u,rdata,0)) {
 		DEBUG(0,("new_spoolss_io_r_enumprinterdrivers: unable to marshall SPOOL_R_ENUMPRINTERDRIVERS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -816,9 +768,6 @@ static BOOL api_spoolss_getform(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_getform("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getform: unable to unmarshall SPOOL_Q_GETFORM.\n"));
 		return False;
@@ -832,12 +781,9 @@ static BOOL api_spoolss_getform(pipes_struct *p)
 
 	if (!new_spoolss_io_r_getform("",&r_u,rdata,0)) {
 		DEBUG(0,("new_spoolss_io_r_getform: unable to marshall SPOOL_R_GETFORM.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -853,9 +799,6 @@ static BOOL api_spoolss_enumforms(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumforms("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumforms: unable to unmarshall SPOOL_Q_ENUMFORMS.\n"));
 		return False;
@@ -870,12 +813,9 @@ static BOOL api_spoolss_enumforms(pipes_struct *p)
 
 	if (!new_spoolss_io_r_enumforms("",&r_u,rdata,0)) {
 		DEBUG(0,("new_spoolss_io_r_enumforms: unable to marshall SPOOL_R_ENUMFORMS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -892,9 +832,6 @@ static BOOL api_spoolss_enumports(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_enumports("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumports: unable to unmarshall SPOOL_Q_ENUMPORTS.\n"));
 		return False;
@@ -909,12 +846,9 @@ static BOOL api_spoolss_enumports(pipes_struct *p)
 
 	if (!new_spoolss_io_r_enumports("",&r_u,rdata,0)) {
 		DEBUG(0,("new_spoolss_io_r_enumports: unable to marshall SPOOL_R_ENUMPORTS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -947,17 +881,6 @@ static BOOL api_spoolss_addprinterex(pipes_struct *p)
 		return False;
 	}
 	
-	if (q_u.info.info_ptr!=0) {
-		switch (q_u.info.level) {
-			case 1:
-				safe_free(q_u.info.info_1);
-				break;
-			case 2:
-				safe_free(q_u.info.info_2);
-				break;
-		}
-	}
-		
 	return True;
 }
 
@@ -975,7 +898,6 @@ static BOOL api_spoolss_addprinterdriver(pipes_struct *p)
 	
 	if(!spoolss_io_q_addprinterdriver("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_addprinterdriver: unable to unmarshall SPOOL_Q_ADDPRINTERDRIVER.\n"));
-		free_spoolss_q_addprinterdriver(&q_u);
 		return False;
 	}
 	
@@ -983,12 +905,9 @@ static BOOL api_spoolss_addprinterdriver(pipes_struct *p)
 				
 	if(!spoolss_io_r_addprinterdriver("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_addprinterdriver: unable to marshall SPOOL_R_ADDPRINTERDRIVER.\n"));
-		free_spoolss_q_addprinterdriver(&q_u);
 		return False;
 	}
 	
-	free_spoolss_q_addprinterdriver(&q_u);
-
 	return True;
 }
 
@@ -1004,9 +923,6 @@ static BOOL api_spoolss_getprinterdriverdirectory(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_getprinterdriverdir("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getprinterdriverdir: unable to unmarshall SPOOL_Q_GETPRINTERDRIVERDIR.\n"));
 		return False;
@@ -1021,12 +937,9 @@ static BOOL api_spoolss_getprinterdriverdirectory(pipes_struct *p)
 
 	if(!spoolss_io_r_getprinterdriverdir("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_getprinterdriverdir: unable to marshall SPOOL_R_GETPRINTERDRIVERDIR.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -1047,21 +960,16 @@ static BOOL api_spoolss_enumprinterdata(pipes_struct *p)
 		return False;
 	}
 	
-	r_u.status = _spoolss_enumprinterdata(&q_u.handle, q_u.index, q_u.valuesize, q_u.datasize,
+	r_u.status = _spoolss_enumprinterdata(p, &q_u.handle, q_u.index, q_u.valuesize, q_u.datasize,
 						&r_u.valuesize, &r_u.value, &r_u.realvaluesize,
 						&r_u.type,
 						&r_u.datasize, &r_u.data, &r_u.realdatasize);
 				
 	if(!spoolss_io_r_enumprinterdata("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_enumprinterdata: unable to marshall SPOOL_R_ENUMPRINTERDATA.\n"));
-		safe_free(r_u.value);
-		safe_free(r_u.data);
 		return False;
 	}
 
-	safe_free(r_u.value);
-	safe_free(r_u.data);
-
 	return True;
 }
 
@@ -1086,8 +994,6 @@ static BOOL api_spoolss_setprinterdata(pipes_struct *p)
 				&q_u.value, q_u.type, q_u.max_len,
 				q_u.data, q_u.real_len, q_u.numeric_data);
 				
-	free_spoolss_q_setprinterdata(&q_u);
-
 	if(!spoolss_io_r_setprinterdata("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_setprinterdata: unable to marshall SPOOL_R_SETPRINTERDATA.\n"));
 		return False;
@@ -1189,9 +1095,6 @@ static BOOL api_spoolss_enumprintprocessors(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 	
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_enumprintprocessors("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprintprocessors: unable to unmarshall SPOOL_Q_ENUMPRINTPROCESSORS.\n"));
 		return False;
@@ -1206,12 +1109,9 @@ static BOOL api_spoolss_enumprintprocessors(pipes_struct *p)
 
 	if(!spoolss_io_r_enumprintprocessors("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_enumprintprocessors: unable to marshall SPOOL_R_ENUMPRINTPROCESSORS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 	
-	new_spoolss_free_buffer(q_u.buffer);
-	
 	return True;
 }
 
@@ -1227,9 +1127,6 @@ static BOOL api_spoolss_enumprintprocdatatypes(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 	
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_enumprintprocdatatypes("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprintprocdatatypes: unable to unmarshall SPOOL_Q_ENUMPRINTPROCDATATYPES.\n"));
 		return False;
@@ -1244,12 +1141,9 @@ static BOOL api_spoolss_enumprintprocdatatypes(pipes_struct *p)
 
 	if(!spoolss_io_r_enumprintprocdatatypes("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_enumprintprocdatatypes: unable to marshall SPOOL_R_ENUMPRINTPROCDATATYPES.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 	
-	new_spoolss_free_buffer(q_u.buffer);
-	
 	return True;
 }
 
@@ -1265,9 +1159,6 @@ static BOOL api_spoolss_enumprintmonitors(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 	
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumprintmonitors("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprintmonitors: unable to unmarshall SPOOL_Q_ENUMPRINTMONITORS.\n"));
 		return False;
@@ -1282,12 +1173,9 @@ static BOOL api_spoolss_enumprintmonitors(pipes_struct *p)
 
 	if (!spoolss_io_r_enumprintmonitors("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_enumprintmonitors: unable to marshall SPOOL_R_ENUMPRINTMONITORS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 	
-	new_spoolss_free_buffer(q_u.buffer);
-	
 	return True;
 }
 
@@ -1300,9 +1188,6 @@ static BOOL api_spoolss_getjob(pipes_struct *p)
 	prs_struct *data = &p->in_data.data;
 	prs_struct *rdata = &p->out_data.rdata;
 	
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_getjob("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getjob: unable to unmarshall SPOOL_Q_GETJOB.\n"));
 		return False;
@@ -1317,11 +1202,9 @@ static BOOL api_spoolss_getjob(pipes_struct *p)
 	
 	if(!spoolss_io_r_getjob("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_getjob: unable to marshall SPOOL_R_GETJOB.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 		
-	new_spoolss_free_buffer(q_u.buffer);
 	return True;
 }
 
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index d5f0703e03..4612384b0d 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -1155,7 +1155,7 @@ static BOOL getprinterdata_printer(POLICY_HND *handle,
 /********************************************************************
  * spoolss_getprinterdata
  ********************************************************************/
-uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
+uint32 _spoolss_getprinterdata(pipes_struct *p, POLICY_HND *handle, UNISTR2 *valuename,
 				uint32 in_size,
 				uint32 *type,
 				uint32 *out_size,
@@ -1199,9 +1199,8 @@ uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
 		DEBUG(5, ("value not found, allocating %d\n", *out_size));
 		/* reply this param doesn't exist */
 		if (*out_size) {
-			if((*data=(uint8 *)malloc(*out_size*sizeof(uint8))) == NULL)
+			if((*data=(uint8 *)talloc_zero(p->mem_ctx, *out_size*sizeof(uint8))) == NULL)
 				return ERROR_NOT_ENOUGH_MEMORY;
-			memset(*data, '\0', *out_size*sizeof(uint8));
 		} else {
 			*data = NULL;
 		}
@@ -2070,7 +2069,9 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int
 	SPOOL_NOTIFY_INFO_DATA *current_data;
 	NT_PRINTER_INFO_LEVEL *printer = NULL;
 	print_queue_struct *queue=NULL;
-	
+	size_t realloc_size = 0;
+	SPOOL_NOTIFY_INFO_DATA *info_data_ptr = NULL;
+
 	type=option_type->type;
 
 	DEBUG(4,("construct_notify_printer_info: Notify type: [%s], number of notify info: [%d] on printer: [%s]\n",
@@ -2087,10 +2088,11 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int
 		if (!search_notify(type, field, &j) )
 			continue;
 		
-		if((info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
+		realloc_size = (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA);
+		if((info_data_ptr=(SPOOL_NOTIFY_INFO_DATA *)Realloc(info_data_ptr, realloc_size)) == NULL) {
 			return False;
 		}
-		current_data=&info->data[info->count];
+		current_data=&info_data_ptr[info->count];
 
 		construct_info_data(current_data, type, field, id);		
 
@@ -2103,6 +2105,12 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int
 		info->count++;
 	}
 
+	if (realloc_size)
+		info->data = talloc_memdup(mem_ctx, info_data_ptr, realloc_size);
+	else
+		info->data = NULL;
+
+	safe_free(info_data_ptr);
 	free_a_printer(&printer, 2);
 	return True;
 }
@@ -2322,9 +2330,8 @@ static uint32 printer_notify_info(POLICY_HND *hnd, SPOOL_NOTIFY_INFO *info,
 /********************************************************************
  * spoolss_rfnpcnex
  ********************************************************************/
-uint32 _spoolss_rfnpcnex( POLICY_HND *handle, uint32 change,
-			  SPOOL_NOTIFY_OPTION *option, TALLOC_CTX *mem_ctx,
-			  SPOOL_NOTIFY_INFO *info)
+uint32 _spoolss_rfnpcnex( pipes_struct *p, POLICY_HND *handle, uint32 change,
+			  SPOOL_NOTIFY_OPTION *option, SPOOL_NOTIFY_INFO *info)
 {
 	Printer_entry *Printer=find_printer_index_by_hnd(handle);
 	uint32 result = ERROR_INVALID_HANDLE;
@@ -2348,18 +2355,16 @@ uint32 _spoolss_rfnpcnex( POLICY_HND *handle, uint32 change,
 	 *	informations even when _NOTHING_ has changed.
 	 */
 
-	/* just discard the SPOOL_NOTIFY_OPTION */
-	if (option!=NULL)
-		safe_free(option->ctr.type);
+	/* just ignore the SPOOL_NOTIFY_OPTION */
 	
 	switch (Printer->printer_type) {
 		case PRINTER_HANDLE_IS_PRINTSERVER:
 			result = printserver_notify_info(handle, info, 
-							 mem_ctx);
+							 p->mem_ctx);
 			break;
 			
 		case PRINTER_HANDLE_IS_PRINTER:
-			result = printer_notify_info(handle, info, mem_ctx);
+			result = printer_notify_info(handle, info, p->mem_ctx);
 			break;
 	}
 	
@@ -2910,7 +2915,6 @@ static BOOL enum_all_printers_info_2(NEW_BUFFER *buffer, uint32 offered, uint32
 	if (!alloc_buffer_size(buffer, *needed)) {
 		for (i=0; i<*returned; i++) {
 			free_devmode(printers[i].devmode);
-			free_sec_desc(&printers[i].secdesc);
 		}
 		safe_free(printers);
 		return ERROR_INSUFFICIENT_BUFFER;
@@ -2923,7 +2927,6 @@ static BOOL enum_all_printers_info_2(NEW_BUFFER *buffer, uint32 offered, uint32
 	/* clear memory */
 	for (i=0; i<*returned; i++) {
 		free_devmode(printers[i].devmode);
-		free_sec_desc(&printers[i].secdesc);
 	}
 	safe_free(printers);
 
@@ -3930,7 +3933,7 @@ static uint32 update_printer_sec(POLICY_HND *handle, uint32 level,
 	   dialog boxes when the user doesn't have permission to change
 	   the security descriptor. */
 
-	nt_printing_getsec(Printer->dev.handlename, &old_secdesc_ctr);
+	nt_printing_getsec(p->mem_ctx, Printer->dev.handlename, &old_secdesc_ctr);
 
 	if (DEBUGLEVEL >= 10) {
 		SEC_ACL *acl;
@@ -3968,7 +3971,7 @@ static uint32 update_printer_sec(POLICY_HND *handle, uint32 level,
 		}
 	}
 
-	new_secdesc_ctr = sec_desc_merge(secdesc_ctr, old_secdesc_ctr);
+	new_secdesc_ctr = sec_desc_merge(p->mem_ctx, secdesc_ctr, old_secdesc_ctr);
 
 	if (sec_desc_equal(new_secdesc_ctr->sec, old_secdesc_ctr->sec)) {
 		result = NT_STATUS_NO_PROBLEMO;
@@ -3992,8 +3995,6 @@ static uint32 update_printer_sec(POLICY_HND *handle, uint32 level,
 	result = nt_printing_setsec(Printer->dev.handlename, new_secdesc_ctr);
 
  done:
-	free_sec_desc_buf(&new_secdesc_ctr);
-	free_sec_desc_buf(&old_secdesc_ctr);
 
 	return result;
 }
@@ -5626,7 +5627,7 @@ uint32 _spoolss_getprinterdriverdirectory(UNISTR2 *name, UNISTR2 *uni_environmen
 	
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_enumprinterdata(POLICY_HND *handle, uint32 idx,
+uint32 _spoolss_enumprinterdata(pipes_struct *p, POLICY_HND *handle, uint32 idx,
 				uint32 in_value_len, uint32 in_data_len,
 				uint32 *out_max_value_len, uint16 **out_value, uint32 *out_value_len,
 				uint32 *out_type,
@@ -5758,24 +5759,22 @@ uint32 _spoolss_enumprinterdata(POLICY_HND *handle, uint32 idx,
 	 */
 	
 	*out_max_value_len=(in_value_len/sizeof(uint16));
-	if((*out_value=(uint16 *)malloc(in_value_len*sizeof(uint8))) == NULL) {
+	if((*out_value=(uint16 *)talloc_zero(p->mem_ctx,in_value_len*sizeof(uint8))) == NULL) {
 		safe_free(data);
 		return ERROR_NOT_ENOUGH_MEMORY;
 	}
 	
-	ZERO_STRUCTP(*out_value);
 	*out_value_len = (uint32)dos_PutUniCode((char *)*out_value, value, in_value_len, True);
 
 	*out_type=type;
 
 	/* the data is counted in bytes */
 	*out_max_data_len=in_data_len;
-	if((*data_out=(uint8 *)malloc(in_data_len*sizeof(uint8))) == NULL) {
+	if((*data_out=(uint8 *)talloc_zero(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL) {
 		safe_free(data);
 		return ERROR_NOT_ENOUGH_MEMORY;
 	}
 	
-	memset(*data_out,'\0',in_data_len);
 	memcpy(*data_out, data, (size_t)data_len);
 	*out_data_len=data_len;
 
diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index cf2bdef314..c326dd561f 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -1099,7 +1099,6 @@ static BOOL set_sd(files_struct *fsp, char *data, uint32 sd_len, uint security_i
 	 */
 
 	if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
-		free_sec_desc(&psd);
 		DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
 		/*
 		 * Return access denied for want of a better error message..
@@ -1122,14 +1121,12 @@ static BOOL set_sd(files_struct *fsp, char *data, uint32 sd_len, uint security_i
 	ret = set_nt_acl( fsp, security_info_sent, psd);
 
 	if (!ret) {
-		free_sec_desc(&psd);
 		talloc_destroy(mem_ctx);
 		*pdef_class = ERRDOS;
 		*pdef_code = ERRnoaccess;
 		return False;
 	}
 
-	free_sec_desc(&psd);
 	talloc_destroy(mem_ctx);
 
 	*pdef_class = 0;
@@ -1638,8 +1635,6 @@ static int call_nt_transact_query_security_desc(connection_struct *conn,
 
   if(max_data_count < sd_size) {
 
-    free_sec_desc(&psd);
-
     send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
                     params, 4, *ppdata, 0);
     return -1;
@@ -1651,7 +1646,6 @@ static int call_nt_transact_query_security_desc(connection_struct *conn,
 
   data = Realloc(*ppdata, sd_size);
   if(data == NULL) {
-    free_sec_desc(&psd);
     return(ERROR(ERRDOS,ERRnomem));
   }
 
@@ -1665,7 +1659,6 @@ static int call_nt_transact_query_security_desc(connection_struct *conn,
 
   if ((mem_ctx = talloc_init()) == NULL) {
     DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
-    free_sec_desc(&psd);
     return(ERROR(ERRDOS,ERRnomem));
   }
 
@@ -1683,7 +1676,6 @@ static int call_nt_transact_query_security_desc(connection_struct *conn,
    */
 
   if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
-    free_sec_desc(&psd);
     DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
 security descriptor.\n"));
     /*
@@ -1697,7 +1689,6 @@ security descriptor.\n"));
    * Now we can delete the security descriptor.
    */
 
-  free_sec_desc(&psd);
   talloc_destroy(mem_ctx);
 
   send_nt_replies(inbuf, outbuf, bufsize, 0, params, 4, data, (int)sd_size);
diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index da457604bb..9c5afad9c1 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -41,6 +41,7 @@ typedef struct canon_ace {
 
 static void free_canon_ace_list( canon_ace *list_head );
 
+#if !defined(HAVE_NO_ACLS)
 /****************************************************************************
  Function to duplicate a canon_ace entry.
 ****************************************************************************/
@@ -56,6 +57,7 @@ static canon_ace *dup_canon_ace( canon_ace *src_ace)
 	dst_ace->prev = dst_ace->next = NULL;
 	return dst_ace;
 }
+#endif /* HAVE_NO_ACLS */
 
 /****************************************************************************
  Function to create owner and group SIDs from a SMB_STRUCT_STAT.
@@ -243,6 +245,7 @@ static BOOL unpack_nt_owners(SMB_STRUCT_STAT *psbuf, uid_t *puser, gid_t *pgrp,
 	return True;
 }
 
+#if !defined(HAVE_NO_ACLS)
 /****************************************************************************
  Merge aces with a common user.
 ****************************************************************************/
@@ -378,6 +381,7 @@ static BOOL ensure_canon_entry_valid(canon_ace **pp_ace,
 
 	return True;
 }
+#endif /* HAVE_NO_ACLS */
 
 /****************************************************************************
  Unpack a SEC_DESC into two canonical ace lists. We don't depend on this
@@ -577,7 +581,6 @@ static BOOL unpack_canon_ace(files_struct *fsp,
 		 */
 
 		DEBUG(10,("unpack_canon_ace: Win2k inherit acl traverse. Ignoring DACL.\n"));
-		free_sec_acl(&psd->dacl);
 	}
 
 	/*
@@ -788,7 +791,6 @@ static BOOL unpack_posix_permissions(files_struct *fsp, SMB_STRUCT_STAT *psbuf,
      */
 
     DEBUG(10,("unpack_posix_permissions: Win2k inherit acl traverse. Ignoring DACL.\n"));
-    free_sec_acl(&psd->dacl);
   }
 
   /*
@@ -1403,13 +1405,13 @@ size_t get_nt_acl(files_struct *fsp, SEC_DESC **ppdesc)
 	}
 
 	if (num_acls) {
-		if((psa = make_sec_acl( ACL_REVISION, num_aces, nt_ace_list)) == NULL) {
+		if((psa = make_sec_acl( main_loop_talloc_get(), ACL_REVISION, num_aces, nt_ace_list)) == NULL) {
 			DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n"));
 			goto done;
 		}
 	}
 
-	*ppdesc = make_standard_sec_desc( &owner_sid, &group_sid, psa, &sd_size);
+	*ppdesc = make_standard_sec_desc( main_loop_talloc_get(), &owner_sid, &group_sid, psa, &sd_size);
 
 	if(!*ppdesc) {
 		DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n"));
@@ -1426,8 +1428,6 @@ size_t get_nt_acl(files_struct *fsp, SEC_DESC **ppdesc)
 	free_canon_ace_list(dir_ace);
 	if (nt_ace_list)
 		free(nt_ace_list);
-	if (psa)
-		free_sec_acl(&psa);
 
 	return sd_size;
 }
@@ -1700,5 +1700,4 @@ int fchmod_acl(int fd, mode_t mode)
 	sys_acl_free_acl(posix_acl);
 	return ret;
 }
-
 #undef OLD_NTDOMAIN