diff options
| -rw-r--r-- | source3/printing/printing.c | 34 |
1 files changed, 18 insertions, 16 deletions
diff --git a/source3/printing/printing.c b/source3/printing/printing.c index bdcd950450..ae7291bfc7 100644 --- a/source3/printing/printing.c +++ b/source3/printing/printing.c @@ -71,7 +71,7 @@ uint16 pjobid_to_rap(int snum, uint32 jobid) key.dsize = sizeof(jinfo); data = tdb_fetch(rap_tdb, key); if (data.dptr && data.dsize == sizeof(uint16)) { - memcpy(&rap_jobid, data.dptr, sizeof(uint16)); + rap_jobid = SVAL(data.dptr, 0); SAFE_FREE(data.dptr); DEBUG(10,("pjobid_to_rap: jobid %u maps to RAP jobid %u\n", (unsigned int)jobid, @@ -149,7 +149,7 @@ static void rap_jobid_delete(int snum, uint32 jobid) DEBUG(10,("rap_jobid_delete: deleting jobid %u\n", (unsigned int)jobid )); - memcpy(&rap_jobid, data.dptr, sizeof(uint16)); + rap_jobid = SVAL(data.dptr, 0); SAFE_FREE(data.dptr); data.dptr = (char *)&rap_jobid; data.dsize = sizeof(rap_jobid); @@ -615,7 +615,7 @@ static void print_unix_job(int snum, print_queue_struct *q, uint32 jobid) pj.spooled = True; fstrcpy(pj.filename, old_pj ? old_pj->filename : ""); if (jobid < UNIX_JOB_START) { - pj.smbjob = (old_pj != NULL ? True : False); + pj.smbjob = True; fstrcpy(pj.jobname, old_pj ? old_pj->jobname : "Remote Downlevel Document"); } else { pj.smbjob = False; @@ -648,7 +648,7 @@ static int traverse_fn_delete(TDB_CONTEXT *t, TDB_DATA key, TDB_DATA data, void if ( key.dsize != sizeof(jobid) ) return 0; - memcpy(&jobid, key.dptr, sizeof(jobid)); + jobid = IVAL(key.dptr, 0); if ( unpack_pjob( data.dptr, data.dsize, &pjob ) == -1 ) return 0; free_nt_devicemode( &pjob.nt_devmode ); @@ -775,7 +775,7 @@ static pid_t get_updating_pid(fstring printer_name) return (pid_t)-1; } - memcpy(&updating_pid, data.dptr, sizeof(pid_t)); + updating_pid = IVAL(data.dptr, 0); SAFE_FREE(data.dptr); if (process_exists(updating_pid)) @@ -921,7 +921,7 @@ static void check_job_changed(int snum, TDB_DATA data, uint32 jobid) for (i = 0; i < job_count; i++) { uint32 ch_jobid; - memcpy(&ch_jobid, data.dptr + (i*4), 4); + ch_jobid = IVAL(data.dptr, i*4); if (ch_jobid == jobid) remove_from_jobs_changed(snum, jobid); } @@ -1407,7 +1407,7 @@ static BOOL remove_from_jobs_changed(int snum, uint32 jobid) for (i = 0; i < job_count; i++) { uint32 ch_jobid; - memcpy(&ch_jobid, data.dptr + (i*4), 4); + ch_jobid = IVAL(data.dptr, i*4); if (ch_jobid == jobid) { if (i < job_count -1 ) memmove(data.dptr + (i*4), data.dptr + (i*4) + 4, (job_count - i - 1)*4 ); @@ -1754,6 +1754,8 @@ static int get_queue_status(int snum, print_status_struct *status) data = tdb_fetch(pdb->tdb, key); if (data.dptr) { if (data.dsize == sizeof(print_status_struct)) + /* this memcpy is ok since the status struct was + not packed before storing it in the tdb */ memcpy(status, data.dptr, sizeof(print_status_struct)); SAFE_FREE(data.dptr); } @@ -2124,12 +2126,10 @@ static BOOL get_stored_queue_info(struct tdb_print_db *pdb, int snum, int *pcoun /* Get the stored queue data. */ data = tdb_fetch(pdb->tdb, key); - - if (data.dptr == NULL || data.dsize < 4) - qcount = 0; - else - memcpy(&qcount, data.dptr, 4); - + + if (data.dptr && data.dsize >= sizeof(qcount)) + len += tdb_unpack(data.dptr + len, data.dsize - len, "d", &qcount); + /* Get the changed jobs list. */ key.dptr = "INFO/jobs_changed"; key.dsize = strlen(key.dptr); @@ -2148,10 +2148,10 @@ static BOOL get_stored_queue_info(struct tdb_print_db *pdb, int snum, int *pcoun goto out; /* Retrieve the linearised queue data. */ - len = 0; + for( i = 0; i < qcount; i++) { uint32 qjob, qsize, qpage_count, qstatus, qpriority, qtime; - len += tdb_unpack(data.dptr + 4 + len, data.dsize - len, "ddddddff", + len += tdb_unpack(data.dptr + len, data.dsize - len, "ddddddff", &qjob, &qsize, &qpage_count, @@ -2175,7 +2175,7 @@ static BOOL get_stored_queue_info(struct tdb_print_db *pdb, int snum, int *pcoun uint32 jobid; struct printjob *pjob; - memcpy(&jobid, &cgdata.dptr[i*4], 4); + jobid = IVAL(&cgdata.dptr, i*4); DEBUG(5,("get_stored_queue_info: changed job = %u\n", (unsigned int)jobid)); pjob = print_job_find(snum, jobid); if (!pjob) { @@ -2260,6 +2260,8 @@ int print_queue_status(int snum, data = tdb_fetch(pdb->tdb, key); if (data.dptr) { if (data.dsize == sizeof(*status)) { + /* this memcpy is ok since the status struct was + not packed before storing it in the tdb */ memcpy(status, data.dptr, sizeof(*status)); } SAFE_FREE(data.dptr); |