diff options
| -rw-r--r-- | source3/rpc_parse/parse_spoolss.c | 22 | ||||
| -rw-r--r-- | source3/rpc_server/srv_spoolss_nt.c | 11 |
2 files changed, 24 insertions, 9 deletions
diff --git a/source3/rpc_parse/parse_spoolss.c b/source3/rpc_parse/parse_spoolss.c index 0a4375c1d4..3774a91100 100644 --- a/source3/rpc_parse/parse_spoolss.c +++ b/source3/rpc_parse/parse_spoolss.c @@ -2540,16 +2540,28 @@ static BOOL new_spoolss_io_buffer(char *desc, prs_struct *ps, int depth, NEW_BUF return True; } else { + BOOL ret = False; + /* writing */ - if (buffer->ptr==0) + if (buffer->ptr==0) { + /* We have finished with the data in buffer->prs - free it. */ + prs_mem_free(&buffer->prs); return True; - + } + if (!prs_uint32("size", ps, depth, &buffer->size)) - return False; + goto out; + if (!prs_append_some_prs_data(ps, &buffer->prs, 0, buffer->size)) - return False; + goto out; - return True; + ret = True; + out: + + /* We have finished with the data in buffer->prs - free it. */ + prs_mem_free(&buffer->prs); + + return ret; } } diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c index 5e666a9a7a..95bb64fef3 100644 --- a/source3/rpc_server/srv_spoolss_nt.c +++ b/source3/rpc_server/srv_spoolss_nt.c @@ -158,7 +158,7 @@ static void free_spool_notify_option(SPOOL_NOTIFY_OPTION **pp) SPOOL_NOTIFY_OPTION *dup_spool_notify_option(SPOOL_NOTIFY_OPTION *sp) { - SPOOL_NOTIFY_OPTION *new_sp = malloc(sizeof(SPOOL_NOTIFY_OPTION)); + SPOOL_NOTIFY_OPTION *new_sp = NULL; if (!sp) return NULL; @@ -825,6 +825,9 @@ uint32 _spoolss_open_printer_ex( pipes_struct *p, SPOOL_Q_OPEN_PRINTER_EX *q_u, } else if ((printer_default->access_required & SERVER_ACCESS_ADMINISTER ) == SERVER_ACCESS_ADMINISTER) { + if (!get_printer_snum(handle, &snum)) + return ERROR_INVALID_HANDLE; + if (!lp_ms_add_printer_wizard()) { close_printer_handle(handle); return ERROR_ACCESS_DENIED; @@ -843,13 +846,13 @@ uint32 _spoolss_open_printer_ex( pipes_struct *p, SPOOL_Q_OPEN_PRINTER_EX *q_u, /* NT doesn't let us connect to a printer if the connecting user doesn't have print permission. */ - if (!get_printer_snum(handle, &snum)) - return ERROR_INVALID_HANDLE; - /* map an empty access mask to the minimum access mask */ if (printer_default->access_required == 0x0) printer_default->access_required = PRINTER_ACCESS_USE; + if (!get_printer_snum(handle, &snum)) + return ERROR_INVALID_HANDLE; + if (!print_access_check(&user, snum, printer_default->access_required)) { DEBUG(3, ("access DENIED for printer open\n")); close_printer_handle(handle); |