5 files changed, 13 insertions, 11 deletions
diff --git a/source3/librpc/idl/lsa.idl b/source3/librpc/idl/lsa.idl
index a443448871..1f48e317c9 100644
--- a/source3/librpc/idl/lsa.idl
+++ b/source3/librpc/idl/lsa.idl
@@ -91,14 +91,12 @@ import "misc.idl", "security.idl";
 
 	/******************/
 	/* Function: 0x03 */
-
 	NTSTATUS lsa_QuerySecurity (
-		[in]     policy_handle *handle,
-		[in]         security_secinfo sec_info,
-		[out,ref]    sec_desc_buf **sdbuf
+		[in]		policy_handle *handle,
+		[in]		security_secinfo sec_info,
+		[out,ref]	sec_desc_buf **sdbuf
 		);
 
-
 	/******************/
 	/* Function: 0x04 */
 	NTSTATUS lsa_SetSecObj(
diff --git a/source4/librpc/idl/lsa.idl b/source4/librpc/idl/lsa.idl
index 4a7a42b4dc..45206a6fda 100644
--- a/source4/librpc/idl/lsa.idl
+++ b/source4/librpc/idl/lsa.idl
@@ -91,14 +91,12 @@ import "misc.idl", "security.idl";
 
 	/******************/
 	/* Function: 0x03 */
-
 	NTSTATUS lsa_QuerySecurity (
-		[in]     policy_handle *handle,
-		[in]         security_secinfo sec_info,
-		[out,unique]        sec_desc_buf *sdbuf
+		[in]		policy_handle *handle,
+		[in]		security_secinfo sec_info,
+		[out,ref]	sec_desc_buf **sdbuf
 		);
 
-
 	/******************/
 	/* Function: 0x04 */
 	NTSTATUS lsa_SetSecObj(
diff --git a/source4/torture/rpc/handles.c b/source4/torture/rpc/handles.c
index f35897b3df..553025276d 100644
--- a/source4/torture/rpc/handles.c
+++ b/source4/torture/rpc/handles.c
@@ -109,6 +109,7 @@ static bool test_handles_lsa_shared(struct torture_context *torture)
 	struct lsa_OpenPolicy r;
 	struct lsa_Close c;
 	struct lsa_QuerySecurity qsec;
+	struct sec_desc_buf *sdbuf = NULL;
 	uint16_t system_name = '\\';
 	TALLOC_CTX *mem_ctx = talloc_new(torture);
 	enum dcerpc_transport_t transport;
@@ -167,6 +168,7 @@ static bool test_handles_lsa_shared(struct torture_context *torture)
 
 	qsec.in.handle 		= &handle;
 	qsec.in.sec_info	= 0;
+	qsec.out.sdbuf		= &sdbuf;
 	c.in.handle = &handle;
 	c.out.handle = &handle2;
 
diff --git a/source4/torture/rpc/lsa.c b/source4/torture/rpc/lsa.c
index 69df965f19..8ac337c740 100644
--- a/source4/torture/rpc/lsa.c
+++ b/source4/torture/rpc/lsa.c
@@ -1462,6 +1462,7 @@ static bool test_QuerySecurity(struct dcerpc_pipe *p,
 {
 	NTSTATUS status;
 	struct lsa_QuerySecurity r;
+	struct sec_desc_buf *sdbuf = NULL;
 
 	if (torture_setting_bool(tctx, "samba4", false)) {
 		printf("\nskipping QuerySecurity test against Samba4\n");
@@ -1472,6 +1473,7 @@ static bool test_QuerySecurity(struct dcerpc_pipe *p,
 
 	r.in.handle = acct_handle;
 	r.in.sec_info = 7;
+	r.out.sdbuf = &sdbuf;
 
 	status = dcerpc_lsa_QuerySecurity(p, tctx, &r);
 	if (!NT_STATUS_IS_OK(status)) {
diff --git a/source4/torture/rpc/samsync.c b/source4/torture/rpc/samsync.c
index 2d2aaa80d6..257d2c81bc 100644
--- a/source4/torture/rpc/samsync.c
+++ b/source4/torture/rpc/samsync.c
@@ -204,10 +204,12 @@ static struct sec_desc_buf *samsync_query_lsa_sec_desc(TALLOC_CTX *mem_ctx,
 						       struct policy_handle *handle) 
 {
 	struct lsa_QuerySecurity r;
+	struct sec_desc_buf *sdbuf = NULL;
 	NTSTATUS status;
 
 	r.in.handle = handle;
 	r.in.sec_info = 0x7;
+	r.out.sdbuf = &sdbuf;
 
 	status = dcerpc_lsa_QuerySecurity(samsync_state->p_lsa, mem_ctx, &r);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -215,7 +217,7 @@ static struct sec_desc_buf *samsync_query_lsa_sec_desc(TALLOC_CTX *mem_ctx,
 		return NULL;
 	}
 
-	return r.out.sdbuf;
+	return sdbuf;
 }
 
 #define TEST_UINT64_EQUAL(i1, i2) do {\