2 files changed, 40 insertions, 7 deletions

diff --git a/source3/rpc_client/cli_spoolss.c b/source3/rpc_client/cli_spoolss.c
index 02a0e168cb..2dba103069 100644
--- a/source3/rpc_client/cli_spoolss.c
+++ b/source3/rpc_client/cli_spoolss.c
@@ -810,27 +810,45 @@ WERROR rpccli_spoolss_enumprinterkey(struct rpc_pipe_client *cli,
 	NTSTATUS status;
 	WERROR werror;
 	uint32_t needed;
+	uint16_t *buffer = NULL;
+
+	*key_buffer = NULL;
+
+	if (offered) {
+		buffer = talloc_array(mem_ctx, uint16_t, offered);
+		W_ERROR_HAVE_NO_MEMORY(buffer);
+	}
 
 	status = rpccli_spoolss_EnumPrinterKey(cli, mem_ctx,
 					       handle,
 					       key_name,
-					       key_buffer,
+					       buffer,
 					       offered,
 					       &needed,
 					       &werror);
 
 	if (W_ERROR_EQUAL(werror, WERR_MORE_DATA)) {
 		offered = needed;
-
+		buffer = talloc_realloc(mem_ctx, buffer, uint16_t, needed);
+		W_ERROR_HAVE_NO_MEMORY(buffer);
 		status = rpccli_spoolss_EnumPrinterKey(cli, mem_ctx,
 						       handle,
 						       key_name,
-						       key_buffer,
+						       buffer,
 						       offered,
 						       &needed,
 						       &werror);
 	}
 
+	if (W_ERROR_IS_OK(werror)) {
+		const char **array;
+		DATA_BLOB blob = data_blob_const((uint8_t *)buffer, offered);
+		if (!pull_reg_multi_sz(mem_ctx, &blob, &array)) {
+			return WERR_NOMEM;
+		}
+		*key_buffer = array;
+	}
+
 	return werror;
 }
 
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index 682a59b5a8..525e972a6b 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -9335,7 +9335,7 @@ WERROR _spoolss_EnumPrinterKey(pipes_struct *p,
 	WERROR		result = WERR_BADFILE;
 	int i;
 	const char **array = NULL;
-
+	DATA_BLOB blob;
 
 	DEBUG(4,("_spoolss_EnumPrinterKey\n"));
 
@@ -9364,7 +9364,9 @@ WERROR _spoolss_EnumPrinterKey(pipes_struct *p,
 		goto done;
 	}
 
-	*r->out.needed = 4;
+	/* two byte termination (a multisz) */
+
+	*r->out.needed = 2;
 
 	array = talloc_zero_array(r->out.key_buffer, const char *, num_keys + 1);
 	if (!array) {
@@ -9373,6 +9375,10 @@ WERROR _spoolss_EnumPrinterKey(pipes_struct *p,
 	}
 
 	for (i=0; i < num_keys; i++) {
+
+		DEBUG(10,("_spoolss_EnumPrinterKey: adding keyname: %s\n",
+			keynames[i]));
+
 		array[i] = talloc_strdup(array, keynames[i]);
 		if (!array[i]) {
 			result = WERR_NOMEM;
@@ -9389,12 +9395,21 @@ WERROR _spoolss_EnumPrinterKey(pipes_struct *p,
 
 	result = WERR_OK;
 
-	*r->out.key_buffer = array;
+	if (!push_reg_multi_sz(p->mem_ctx, &blob, array)) {
+		result = WERR_NOMEM;
+		goto done;
+	}
+
+	if (r->in.offered == blob.length) {
+		memcpy(r->out.key_buffer, blob.data, blob.length);
+	}
 
  done:
 	if (!W_ERROR_IS_OK(result)) {
 		TALLOC_FREE(array);
-		ZERO_STRUCTP(r->out.key_buffer);
+		if (!W_ERROR_EQUAL(result, WERR_MORE_DATA)) {
+			*r->out.needed = 0;
+		}
 	}
 
 	free_a_printer(&printer, 2);