diff options
| -rw-r--r-- | source3/rpc_parse/parse_spoolss.c | 4 | ||||
| -rw-r--r-- | source3/rpc_server/srv_spoolss_nt.c | 29 |
2 files changed, 23 insertions, 10 deletions
diff --git a/source3/rpc_parse/parse_spoolss.c b/source3/rpc_parse/parse_spoolss.c index 5ed7ce2460..e81f0c286f 100644 --- a/source3/rpc_parse/parse_spoolss.c +++ b/source3/rpc_parse/parse_spoolss.c @@ -3705,7 +3705,7 @@ void free_spool_printer_driver_info_level_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 ** free_buffer5(&il->dependentfiles); - safe_free(q_u); + safe_free(il); } /******************************************************************* @@ -3857,7 +3857,7 @@ void free_spool_printer_driver_info_level_6(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 ** free_buffer5(&il->dependentfiles); free_buffer5(&il->previousnames); - safe_free(q_u); + safe_free(il); } diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c index b77deca158..e88aa9fa72 100644 --- a/source3/rpc_server/srv_spoolss_nt.c +++ b/source3/rpc_server/srv_spoolss_nt.c @@ -560,7 +560,7 @@ static BOOL convert_printer_info(const SPOOL_PRINTER_INFO_LEVEL *uni, { switch (level) { case 2: - uni_2_asc_printer_info_2(uni->info_2, &(printer->info_2)); + uni_2_asc_printer_info_2(uni->info_2, &printer->info_2); break; default: break; @@ -3793,13 +3793,16 @@ static uint32 spoolss_addprinterex_level_2( const UNISTR2 *uni_srv_name, fstring name; fstring share_name; + if ((printer = (NT_PRINTER_INFO_LEVEL *)malloc(sizeof(NT_PRINTER_INFO_LEVEL))) == NULL) { + DEBUG(0,("spoolss_addprinterex_level_2: malloc fail.\n")); + return ERROR_NOT_ENOUGH_MEMORY; + } + + ZERO_STRUCTP(printer); + clear_handle(handle); - /* NULLify info_2 here */ - /* don't put it in convert_printer_info as it's used also with non-NULL values */ - printer->info_2=NULL; - - /* convert from UNICODE to ASCII */ + /* convert from UNICODE to ASCII - this allocates the info_2 struct inside *printer.*/ convert_printer_info(info, printer, 2); unistr2_to_ascii(share_name, &info->info_2->printername, sizeof(share_name)-1); @@ -3807,23 +3810,28 @@ static uint32 spoolss_addprinterex_level_2( const UNISTR2 *uni_srv_name, slprintf(name, sizeof(name)-1, "\\\\%s\\%s", global_myname, share_name); /* write the ASCII on disk */ - if (add_a_printer(*printer, 2) != 0x0) + if (add_a_printer(*printer, 2) != 0) { + free_a_printer(&printer,2); return ERROR_ACCESS_DENIED; + } create_printer_hnd(handle); open_printer_hnd(handle); if (!set_printer_hnd_printertype(handle, name)) { + free_a_printer(&printer,2); close_printer_handle(handle); return ERROR_ACCESS_DENIED; } if (!set_printer_hnd_printername(handle, name)) { + free_a_printer(&printer,2); close_printer_handle(handle); return ERROR_ACCESS_DENIED; } + free_a_printer(&printer,2); return NT_STATUS_NO_PROBLEMO; } @@ -3862,6 +3870,7 @@ static uint32 modify_driver_heirarchy(NT_PRINTER_DRIVER_INFO_LEVEL *driver, uint pstring path_old; pstring path_new; pstring short_archi; + pstring model_name; /* find_service is an smbd-specific function call */ int snum = find_service("print$"); @@ -3885,7 +3894,11 @@ static uint32 modify_driver_heirarchy(NT_PRINTER_DRIVER_INFO_LEVEL *driver, uint slprintf(path_old, sizeof(path_old)-1, "%s/%s/TMP_%u", lp_pathname(snum), short_archi, (unsigned int)sys_getpid()); - slprintf(path_new, sizeof(path_new)-1, "%s/%s/%s", lp_pathname(snum), short_archi, model); + + /* Clean up any '/' and other characters in the model name. */ + alpha_strcpy(model_name, model, sizeof(pstring)); + + slprintf(path_new, sizeof(path_new)-1, "%s/%s/%s", lp_pathname(snum), short_archi, model_name); DEBUG(10,("modify_driver_heirarchy: old_path=%s, new_path=%s\n", path_old, path_new )); |