5 files changed, 23 insertions, 11 deletions

diff --git a/source3/librpc/idl/lsa.idl b/source3/librpc/idl/lsa.idl
index 570a7c0d04..cb1f2b028b 100644
--- a/source3/librpc/idl/lsa.idl
+++ b/source3/librpc/idl/lsa.idl
@@ -769,7 +769,7 @@ import "misc.idl", "security.idl";
 
 
 	/* Function:      0x20 */
-	NTSTATUS lsa_LookupPrivName (
+	NTSTATUS lsa_LookupPrivName(
 		[in]     policy_handle *handle,
 		[in,ref] lsa_LUID *luid,
 		[out,ref] lsa_StringLarge **name
diff --git a/source4/librpc/idl/lsa.idl b/source4/librpc/idl/lsa.idl
index 00e2e7753b..0f22ca7de1 100644
--- a/source4/librpc/idl/lsa.idl
+++ b/source4/librpc/idl/lsa.idl
@@ -764,10 +764,10 @@ import "misc.idl", "security.idl";
 
 
 	/* Function:      0x20 */
-	NTSTATUS lsa_LookupPrivName (
+	NTSTATUS lsa_LookupPrivName(
 		[in]     policy_handle *handle,
-		[in]     lsa_LUID *luid,
-		[out,unique]        lsa_StringLarge *name
+		[in,ref] lsa_LUID *luid,
+		[out,ref] lsa_StringLarge **name
 		);
 
 
diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c
index 7936369df4..d88a87632a 100644
--- a/source4/rpc_server/lsa/dcesrv_lsa.c
+++ b/source4/rpc_server/lsa/dcesrv_lsa.c
@@ -2711,6 +2711,7 @@ static NTSTATUS dcesrv_lsa_LookupPrivName(struct dcesrv_call_state *dce_call,
 {
 	struct dcesrv_handle *h;
 	struct lsa_policy_state *state;
+	struct lsa_StringLarge *name;
 	const char *privname;
 
 	DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
@@ -2726,11 +2727,14 @@ static NTSTATUS dcesrv_lsa_LookupPrivName(struct dcesrv_call_state *dce_call,
 		return NT_STATUS_NO_SUCH_PRIVILEGE;
 	}
 
-	r->out.name = talloc(mem_ctx, struct lsa_StringLarge);
-	if (r->out.name == NULL) {
+	name = talloc(mem_ctx, struct lsa_StringLarge);
+	if (name == NULL) {
 		return NT_STATUS_NO_MEMORY;
 	}
-	r->out.name->string = privname;
+
+	name->string = privname;
+
+	*r->out.name = name;
 
 	return NT_STATUS_OK;	
 }
diff --git a/source4/torture/rpc/lsa.c b/source4/torture/rpc/lsa.c
index 62e0c22ce2..e065c294d9 100644
--- a/source4/torture/rpc/lsa.c
+++ b/source4/torture/rpc/lsa.c
@@ -767,9 +767,11 @@ static bool test_LookupPrivName(struct dcerpc_pipe *p,
 {
 	NTSTATUS status;
 	struct lsa_LookupPrivName r;
+	struct lsa_StringLarge *name = NULL;
 
 	r.in.handle = handle;
 	r.in.luid = luid;
+	r.out.name = &name;
 
 	status = dcerpc_lsa_LookupPrivName(p, mem_ctx, &r);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -807,22 +809,24 @@ static bool test_RemovePrivilegesFromAccount(struct dcerpc_pipe *p,
 	if (!NT_STATUS_IS_OK(status)) {
 		
 		struct lsa_LookupPrivName r_name;
+		struct lsa_StringLarge *name = NULL;
 		
 		r_name.in.handle = handle;
 		r_name.in.luid = luid;
-		
+		r_name.out.name = &name;
+
 		status = dcerpc_lsa_LookupPrivName(p, mem_ctx, &r_name);
 		if (!NT_STATUS_IS_OK(status)) {
 			printf("\nLookupPrivName failed - %s\n", nt_errstr(status));
 			return false;
 		}
 		/* Windows 2008 does not allow this to be removed */
-		if (strcmp("SeAuditPrivilege", r_name.out.name->string) == 0) {
+		if (strcmp("SeAuditPrivilege", name->string) == 0) {
 			return ret;
 		}
 
 		printf("RemovePrivilegesFromAccount failed to remove %s - %s\n", 
-		       r_name.out.name->string, 
+		       name->string,
 		       nt_errstr(status));
 		return false;
 	}
diff --git a/source4/torture/rpc/samsync.c b/source4/torture/rpc/samsync.c
index 26660921a4..14c05b2c05 100644
--- a/source4/torture/rpc/samsync.c
+++ b/source4/torture/rpc/samsync.c
@@ -1073,8 +1073,12 @@ static bool samsync_handle_account(TALLOC_CTX *mem_ctx, struct samsync_state *sa
 	TEST_INT_EQUAL(account->privilege_entries, privs->count);
 	
 	for (i=0;i< privs->count; i++) {
+
+		struct lsa_StringLarge *name = NULL;
+
 		r.in.handle = samsync_state->lsa_handle;
 		r.in.luid = &privs->set[i].luid;
+		r.out.name = &name;
 		
 		status = dcerpc_lsa_LookupPrivName(samsync_state->p_lsa, mem_ctx, &r);
 		if (!NT_STATUS_IS_OK(status)) {
@@ -1087,7 +1091,7 @@ static bool samsync_handle_account(TALLOC_CTX *mem_ctx, struct samsync_state *sa
 			return false;
 		}
 		for (j=0;j<account->privilege_entries; j++) {
-			if (strcmp(r.out.name->string, account->privilege_name[j].string) == 0) {
+			if (strcmp(name->string, account->privilege_name[j].string) == 0) {
 				found_priv_in_lsa[j] = true;
 				break;
 			}