summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--source3/include/proto.h4
-rw-r--r--source3/printing/nt_printing.c50
-rw-r--r--source3/rpc_parse/parse_spoolss.c26
-rwxr-xr-xsource3/rpc_server/srv_spoolss.c39
-rw-r--r--source3/rpc_server/srv_spoolss_nt.c195
5 files changed, 215 insertions, 99 deletions
diff --git a/source3/include/proto.h b/source3/include/proto.h
index c74d775329..9552dc3d1d 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1519,7 +1519,7 @@ BOOL trust_get_passwd( unsigned char trust_passwd[16], char *domain, char *mynam
int get_ntforms(nt_forms_struct **list);
int write_ntforms(nt_forms_struct **list, int number);
-void add_a_form(nt_forms_struct **list, const FORM *form, int *count);
+BOOL add_a_form(nt_forms_struct **list, const FORM *form, int *count);
void update_a_form(nt_forms_struct **list, const FORM *form, int count);
int get_ntdrivers(fstring **list, char *architecture);
void get_short_archi(char *short_archi, char *long_archi);
@@ -2369,7 +2369,7 @@ BOOL new_smb_io_job_info_1(char *desc, NEW_BUFFER *buffer, JOB_INFO_1 *info, int
BOOL new_smb_io_job_info_2(char *desc, NEW_BUFFER *buffer, JOB_INFO_2 *info, int depth);
BOOL new_smb_io_form_1(char *desc, NEW_BUFFER *buffer, FORM_1 *info, int depth);
void new_spoolss_move_buffer(NEW_BUFFER *src, NEW_BUFFER **dest);
-void new_spoolss_allocate_buffer(NEW_BUFFER **buffer);
+BOOL new_spoolss_allocate_buffer(NEW_BUFFER **buffer);
void new_spoolss_free_buffer(NEW_BUFFER *buffer);
uint32 new_get_buffer_size(NEW_BUFFER *buffer);
BOOL new_smb_io_driverdir_1(char *desc, NEW_BUFFER *buffer, DRIVER_DIRECTORY_1 *info, int depth);
diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index 641ec4e3f6..39a44bdcf2 100644
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -148,7 +148,7 @@ int write_ntforms(nt_forms_struct **list, int number)
/****************************************************************************
add a form struct at the end of the list
****************************************************************************/
-void add_a_form(nt_forms_struct **list, const FORM *form, int *count)
+BOOL add_a_form(nt_forms_struct **list, const FORM *form, int *count)
{
int n=0;
BOOL update;
@@ -174,7 +174,8 @@ void add_a_form(nt_forms_struct **list, const FORM *form, int *count)
if (update==False)
{
- *list=Realloc(*list, (n+1)*sizeof(nt_forms_struct));
+ if((*list=Realloc(*list, (n+1)*sizeof(nt_forms_struct))) == NULL)
+ return False;
unistr2_to_ascii((*list)[n].name, &(form->name), sizeof((*list)[n].name)-1);
(*count)++;
}
@@ -186,6 +187,8 @@ void add_a_form(nt_forms_struct **list, const FORM *form, int *count)
(*list)[n].top=form->top;
(*list)[n].right=form->right;
(*list)[n].bottom=form->bottom;
+
+ return True;
}
/****************************************************************************
@@ -254,7 +257,10 @@ int get_ntdrivers(fstring **list, char *architecture)
fstrcpy(driver_name, dpname+match_len);
all_string_sub(driver_name, "#", "/", 0);
- *list = Realloc(*list, sizeof(fstring)*(total+1));
+
+ if((*list = Realloc(*list, sizeof(fstring)*(total+1))) == NULL)
+ return -1;
+
StrnCpy((*list)[total], driver_name, strlen(driver_name));
DEBUGADD(106,("Added: [%s]\n", driver_name));
total++;
@@ -832,6 +838,8 @@ static void free_nt_printer_param(NT_PRINTER_PARAM **param_ptr)
if(param == NULL)
return;
+ DEBUG(106,("free_nt_printer_param: deleting param [%s]\n", param->value));
+
if(param->data)
free(param->data);
@@ -850,6 +858,8 @@ static void free_nt_devicemode(NT_DEVICEMODE **devmode_ptr)
if(nt_devmode == NULL)
return;
+ DEBUG(106,("free_nt_devicemode: deleting DEVMODE\n"));
+
if(nt_devmode->private)
free(nt_devmode->private);
@@ -869,6 +879,8 @@ static void free_nt_printer_info_level_2(NT_PRINTER_INFO_LEVEL_2 **info_ptr)
if(info == NULL)
return;
+ DEBUG(106,("free_nt_printer_info_level_2: deleting info\n"));
+
free_nt_devicemode(&info->devmode);
for(param_ptr = info->specific; param_ptr; ) {
@@ -1223,6 +1235,8 @@ uint32 get_a_printer(NT_PRINTER_INFO_LEVEL *printer, uint32 level, fstring share
{
uint32 success;
+ DEBUG(10,("get_a_printer: [%s] level %u\n", sharename, (unsigned int)level));
+
switch (level)
{
case 2:
@@ -1237,6 +1251,9 @@ uint32 get_a_printer(NT_PRINTER_INFO_LEVEL *printer, uint32 level, fstring share
}
dump_a_printer(*printer, level);
+
+ DEBUG(10,("get_a_printer: [%s] level %u returning %u\n", sharename, (unsigned int)level, (unsigned int)success));
+
return (success);
}
@@ -1253,32 +1270,7 @@ uint32 free_a_printer(NT_PRINTER_INFO_LEVEL printer, uint32 level)
{
if (printer.info_2 != NULL)
{
- if ((printer.info_2)->devmode != NULL)
- {
- DEBUG(106,("deleting DEVMODE\n"));
- if ((printer.info_2)->devmode->private !=NULL )
- free((printer.info_2)->devmode->private);
- free((printer.info_2)->devmode);
- }
-
- if ((printer.info_2)->specific != NULL)
- {
- NT_PRINTER_PARAM *param;
- NT_PRINTER_PARAM *next_param;
-
- param=(printer.info_2)->specific;
-
- while ( param != NULL)
- {
- next_param=param->next;
- DEBUG(106,("deleting param [%s]\n", param->value));
- free(param->data);
- free(param);
- param=next_param;
- }
- }
-
- free(printer.info_2);
+ free_nt_printer_info_level_2(&printer.info_2);
success=0;
}
else
diff --git a/source3/rpc_parse/parse_spoolss.c b/source3/rpc_parse/parse_spoolss.c
index fd053dbf45..6c62b66277 100644
--- a/source3/rpc_parse/parse_spoolss.c
+++ b/source3/rpc_parse/parse_spoolss.c
@@ -264,7 +264,8 @@ static BOOL smb_io_notify_option_type_ctr(char *desc, SPOOL_NOTIFY_OPTION_TYPE_C
/* reading */
if (UNMARSHALLING(ps))
- ctr->type=(SPOOL_NOTIFY_OPTION_TYPE *)malloc(ctr->count*sizeof(SPOOL_NOTIFY_OPTION_TYPE));
+ if((ctr->type=(SPOOL_NOTIFY_OPTION_TYPE *)malloc(ctr->count*sizeof(SPOOL_NOTIFY_OPTION_TYPE))) == NULL)
+ return False;
/* the option type struct */
for(i=0;i<ctr->count;i++)
@@ -1133,7 +1134,8 @@ BOOL spoolss_io_q_rffpcnex(char *desc, SPOOL_Q_RFFPCNEX *q_u, prs_struct *ps, in
if (q_u->option_ptr!=0) {
if (UNMARSHALLING(ps))
- q_u->option=(SPOOL_NOTIFY_OPTION *)malloc(sizeof(SPOOL_NOTIFY_OPTION));
+ if((q_u->option=(SPOOL_NOTIFY_OPTION *)malloc(sizeof(SPOOL_NOTIFY_OPTION))) == NULL)
+ return False;
if(!smb_io_notify_option("notify option", q_u->option, ps, depth))
return False;
@@ -1181,7 +1183,8 @@ BOOL spoolss_io_q_rfnpcnex(char *desc, SPOOL_Q_RFNPCNEX *q_u, prs_struct *ps, in
if (q_u->option_ptr!=0) {
if (UNMARSHALLING(ps))
- q_u->option=(SPOOL_NOTIFY_OPTION *)malloc(sizeof(SPOOL_NOTIFY_OPTION));
+ if((q_u->option=(SPOOL_NOTIFY_OPTION *)malloc(sizeof(SPOOL_NOTIFY_OPTION))) == NULL)
+ return False;
if(!smb_io_notify_option("notify option", q_u->option, ps, depth))
return False;
@@ -1421,7 +1424,8 @@ static BOOL new_smb_io_relarraystr(char *desc, NEW_BUFFER *buffer, int depth, ui
return False;
l_chaine=str_len_uni(&chaine);
- chaine2=(uint16 *)Realloc(chaine2, (l_chaine2+l_chaine+1)*sizeof(uint16));
+ if((chaine2=(uint16 *)Realloc(chaine2, (l_chaine2+l_chaine+1)*sizeof(uint16))) == NULL)
+ return False;
memcpy(chaine2+l_chaine2, chaine.buffer, (l_chaine+1)*sizeof(uint16));
l_chaine2+=l_chaine+1;
@@ -1475,7 +1479,8 @@ static BOOL new_smb_io_reldevmode(char *desc, NEW_BUFFER *buffer, int depth, DEV
prs_set_offset(ps, buffer->string_at_end + buffer->struct_start);
/* read the string */
- *devmode=(DEVICEMODE *)malloc(sizeof(DEVICEMODE));
+ if((*devmode=(DEVICEMODE *)malloc(sizeof(DEVICEMODE))) == NULL)
+ return False;
if (!spoolss_io_devmode(desc, ps, depth, *devmode))
return False;
@@ -1976,16 +1981,21 @@ void new_spoolss_move_buffer(NEW_BUFFER *src, NEW_BUFFER **dest)
/*******************************************************************
create a BUFFER struct.
********************************************************************/
-void new_spoolss_allocate_buffer(NEW_BUFFER **buffer)
+BOOL new_spoolss_allocate_buffer(NEW_BUFFER **buffer)
{
if (buffer==NULL)
- return;
+ return False;
- *buffer=(NEW_BUFFER *)malloc(sizeof(NEW_BUFFER));
+ if((*buffer=(NEW_BUFFER *)malloc(sizeof(NEW_BUFFER))) == NULL) {
+ DEBUG(0,("new_spoolss_allocate_buffer: malloc fail for size %u.\n",
+ (unsigned int)sizeof(NEW_BUFFER) ));
+ return False;
+ }
(*buffer)->ptr=0x0;
(*buffer)->size=0;
(*buffer)->string_at_end=0;
+ return True;
}
/*******************************************************************
diff --git a/source3/rpc_server/srv_spoolss.c b/source3/rpc_server/srv_spoolss.c
index f23422d87a..8ae75eec6c 100755
--- a/source3/rpc_server/srv_spoolss.c
+++ b/source3/rpc_server/srv_spoolss.c
@@ -199,7 +199,8 @@ static BOOL api_spoolss_enumprinters(prs_struct *data, prs_struct *rdata)
ZERO_STRUCT(q_u);
ZERO_STRUCT(r_u);
- new_spoolss_allocate_buffer(&q_u.buffer);
+ if(!new_spoolss_allocate_buffer(&q_u.buffer))
+ return False;
if (!spoolss_io_q_enumprinters("", &q_u, data, 0)) {
DEBUG(0,("spoolss_io_q_enumprinters: unable to unmarshall SPOOL_Q_ENUMPRINTERS.\n"));
@@ -237,7 +238,8 @@ static BOOL api_spoolss_getprinter(prs_struct *data, prs_struct *rdata)
ZERO_STRUCT(q_u);
ZERO_STRUCT(r_u);
- new_spoolss_allocate_buffer(&q_u.buffer);
+ if(!new_spoolss_allocate_buffer(&q_u.buffer))
+ return False;
if(!spoolss_io_q_getprinter("", &q_u, data, 0)) {
DEBUG(0,("spoolss_io_q_getprinter: unable to unmarshall SPOOL_Q_GETPRINTER.\n"));
@@ -275,7 +277,8 @@ static BOOL api_spoolss_getprinterdriver2(prs_struct *data, prs_struct *rdata)
ZERO_STRUCT(q_u);
ZERO_STRUCT(r_u);
- new_spoolss_allocate_buffer(&q_u.buffer);
+ if(!new_spoolss_allocate_buffer(&q_u.buffer))
+ return False;
if(!spoolss_io_q_getprinterdriver2("", &q_u, data, 0)) {
DEBUG(0,("spoolss_io_q_getprinterdriver2: unable to unmarshall SPOOL_Q_GETPRINTERDRIVER2.\n"));
@@ -512,7 +515,8 @@ static BOOL api_spoolss_addjob(prs_struct *data, prs_struct *rdata)
ZERO_STRUCT(q_u);
ZERO_STRUCT(r_u);
- new_spoolss_allocate_buffer(&q_u.buffer);
+ if(!new_spoolss_allocate_buffer(&q_u.buffer))
+ return False;
if(!spoolss_io_q_addjob("", &q_u, data, 0)) {
DEBUG(0,("spoolss_io_q_addjob: unable to unmarshall SPOOL_Q_ADDJOB.\n"));
@@ -546,7 +550,8 @@ static BOOL api_spoolss_enumjobs(prs_struct *data, prs_struct *rdata)
ZERO_STRUCT(q_u);
ZERO_STRUCT(r_u);
- new_spoolss_allocate_buffer(&q_u.buffer);
+ if(!new_spoolss_allocate_buffer(&q_u.buffer))
+ return False;
if (!spoolss_io_q_enumjobs("", &q_u, data, 0)) {
DEBUG(0,("spoolss_io_q_enumjobs: unable to unmarshall SPOOL_Q_ENUMJOBS.\n"));
@@ -634,7 +639,8 @@ static BOOL api_spoolss_enumprinterdrivers(prs_struct *data, prs_struct *rdata)
ZERO_STRUCT(q_u);
ZERO_STRUCT(r_u);
- new_spoolss_allocate_buffer(&q_u.buffer);
+ if(!new_spoolss_allocate_buffer(&q_u.buffer))
+ return False;
if (!spoolss_io_q_enumprinterdrivers("", &q_u, data, 0)) {
DEBUG(0,("spoolss_io_q_enumprinterdrivers: unable to unmarshall SPOOL_Q_ENUMPRINTERDRIVERS.\n"));
@@ -670,7 +676,8 @@ static BOOL api_spoolss_enumforms(prs_struct *data, prs_struct *rdata)
ZERO_STRUCT(q_u);
ZERO_STRUCT(r_u);
- new_spoolss_allocate_buffer(&q_u.buffer);
+ if(!new_spoolss_allocate_buffer(&q_u.buffer))
+ return False;
if (!spoolss_io_q_enumforms("", &q_u, data, 0)) {
DEBUG(0,("spoolss_io_q_enumforms: unable to unmarshall SPOOL_Q_ENUMFORMS.\n"));
@@ -706,7 +713,8 @@ static BOOL api_spoolss_enumports(prs_struct *data, prs_struct *rdata)
ZERO_STRUCT(q_u);
ZERO_STRUCT(r_u);
- new_spoolss_allocate_buffer(&q_u.buffer);
+ if(!new_spoolss_allocate_buffer(&q_u.buffer))
+ return False;
if(!spoolss_io_q_enumports("", &q_u, data, 0)) {
DEBUG(0,("spoolss_io_q_enumports: unable to unmarshall SPOOL_Q_ENUMPORTS.\n"));
@@ -807,7 +815,8 @@ static BOOL api_spoolss_getprinterdriverdirectory(prs_struct *data, prs_struct *
ZERO_STRUCT(q_u);
ZERO_STRUCT(r_u);
- new_spoolss_allocate_buffer(&q_u.buffer);
+ if(!new_spoolss_allocate_buffer(&q_u.buffer))
+ return False;
if(!spoolss_io_q_getprinterdriverdir("", &q_u, data, 0)) {
DEBUG(0,("spoolss_io_q_getprinterdriverdir: unable to unmarshall SPOOL_Q_GETPRINTERDRIVERDIR.\n"));
@@ -952,7 +961,8 @@ static BOOL api_spoolss_enumprintprocessors(prs_struct *data, prs_struct *rdata)
ZERO_STRUCT(q_u);
ZERO_STRUCT(r_u);
- new_spoolss_allocate_buffer(&q_u.buffer);
+ if(!new_spoolss_allocate_buffer(&q_u.buffer))
+ return False;
if(!spoolss_io_q_enumprintprocessors("", &q_u, data, 0)) {
DEBUG(0,("spoolss_io_q_enumprintprocessors: unable to unmarshall SPOOL_Q_ENUMPRINTPROCESSORS.\n"));
@@ -987,7 +997,8 @@ static BOOL api_spoolss_enumprintprocdatatypes(prs_struct *data, prs_struct *rda
ZERO_STRUCT(q_u);
ZERO_STRUCT(r_u);
- new_spoolss_allocate_buffer(&q_u.buffer);
+ if(!new_spoolss_allocate_buffer(&q_u.buffer))
+ return False;
if(!spoolss_io_q_enumprintprocdatatypes("", &q_u, data, 0)) {
DEBUG(0,("spoolss_io_q_enumprintprocdatatypes: unable to unmarshall SPOOL_Q_ENUMPRINTPROCDATATYPES.\n"));
@@ -1022,7 +1033,8 @@ static BOOL api_spoolss_enumprintmonitors(prs_struct *data, prs_struct *rdata)
ZERO_STRUCT(q_u);
ZERO_STRUCT(r_u);
- new_spoolss_allocate_buffer(&q_u.buffer);
+ if(!new_spoolss_allocate_buffer(&q_u.buffer))
+ return False;
if (!spoolss_io_q_enumprintmonitors("", &q_u, data, 0)) {
DEBUG(0,("spoolss_io_q_enumprintmonitors: unable to unmarshall SPOOL_Q_ENUMPRINTMONITORS.\n"));
@@ -1054,7 +1066,8 @@ static BOOL api_spoolss_getjob(prs_struct *data, prs_struct *rdata)
SPOOL_Q_GETJOB q_u;
SPOOL_R_GETJOB r_u;
- new_spoolss_allocate_buffer(&q_u.buffer);
+ if(!new_spoolss_allocate_buffer(&q_u.buffer))
+ return False;
if(!spoolss_io_q_getjob("", &q_u, data, 0)) {
DEBUG(0,("spoolss_io_q_getjob: unable to unmarshall SPOOL_Q_GETJOB.\n"));
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index b7533c7873..1d33b1b8bb 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -227,7 +227,9 @@ static BOOL open_printer_hnd(POLICY_HND *hnd)
{
Printer_entry *new_printer;
- new_printer=(Printer_entry *)malloc(sizeof(Printer_entry));
+ if((new_printer=(Printer_entry *)malloc(sizeof(Printer_entry))) == NULL)
+ return False;
+
ZERO_STRUCTP(new_printer);
new_printer->open = True;
@@ -343,6 +345,9 @@ static BOOL set_printer_hnd_printername(POLICY_HND *hnd, char *printername)
if (get_a_printer(&printer, 2, lp_servicename(snum))!=0)
continue;
+ DEBUG(10,("set_printer_hnd_printername: printername [%s], aprinter [%s]\n",
+ printer.info_2->printername, aprinter ));
+
if ( strlen(printer.info_2->printername) != strlen(aprinter) ) {
free_a_printer(printer, 2);
continue;
@@ -551,7 +556,8 @@ static BOOL convert_devicemode(DEVICEMODE devmode, NT_DEVICEMODE *nt_devmode)
/* if we had a previous private delete it and make a new one */
if (nt_devmode->private != NULL)
free(nt_devmode->private);
- nt_devmode->private=(uint8 *)malloc(nt_devmode->driverextra * sizeof(uint8));
+ if((nt_devmode->private=(uint8 *)malloc(nt_devmode->driverextra * sizeof(uint8))) == NULL)
+ return False;
memcpy(nt_devmode->private, devmode.private, nt_devmode->driverextra);
}
@@ -581,7 +587,8 @@ static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **d
if (!strcmp(value, "BeepEnabled"))
{
*type = 0x4;
- *data = (uint8 *)malloc( 4*sizeof(uint8) );
+ if((*data = (uint8 *)malloc( 4*sizeof(uint8) )) == NULL)
+ return False;
SIVAL(*data, 0, 0x01);
*needed = 0x4;
return True;
@@ -590,7 +597,8 @@ static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **d
if (!strcmp(value, "EventLog"))
{
*type = 0x4;
- *data = (uint8 *)malloc( 4*sizeof(uint8) );
+ if((*data = (uint8 *)malloc( 4*sizeof(uint8) )) == NULL)
+ return False;
SIVAL(*data, 0, 0x1B);
*needed = 0x4;
return True;
@@ -599,7 +607,8 @@ static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **d
if (!strcmp(value, "NetPopup"))
{
*type = 0x4;
- *data = (uint8 *)malloc( 4*sizeof(uint8) );
+ if((*data = (uint8 *)malloc( 4*sizeof(uint8) )) == NULL)
+ return False;
SIVAL(*data, 0, 0x01);
*needed = 0x4;
return True;
@@ -608,7 +617,8 @@ static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **d
if (!strcmp(value, "MajorVersion"))
{
*type = 0x4;
- *data = (uint8 *)malloc( 4*sizeof(uint8) );
+ if((*data = (uint8 *)malloc( 4*sizeof(uint8) )) == NULL)
+ return False;
SIVAL(*data, 0, 0x02);
*needed = 0x4;
return True;
@@ -619,7 +629,8 @@ static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **d
pstring string="You are using a Samba server";
*type = 0x1;
*needed = 2*(strlen(string)+1);
- *data = (uint8 *)malloc( ((*needed > in_size) ? *needed:in_size) *sizeof(uint8));
+ if((*data = (uint8 *)malloc( ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
+ return False;
memset(*data, 0, (*needed > in_size) ? *needed:in_size);
/* it's done by hand ready to go on the wire */
@@ -636,7 +647,8 @@ static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **d
pstring string="Windows NT x86";
*type = 0x1;
*needed = 2*(strlen(string)+1);
- *data = (uint8 *)malloc( ((*needed > in_size) ? *needed:in_size) *sizeof(uint8));
+ if((*data = (uint8 *)malloc( ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
+ return False;
memset(*data, 0, (*needed > in_size) ? *needed:in_size);
for (i=0; i<strlen(string); i++)
{
@@ -667,8 +679,11 @@ static BOOL getprinterdata_printer(const POLICY_HND *handle,
if (!OPEN_HANDLE(Printer))
return False;
- get_printer_snum(handle, &snum);
- get_a_printer(&printer, 2, lp_servicename(snum));
+ if(!get_printer_snum(handle, &snum))
+ return False;
+
+ if(get_a_printer(&printer, 2, lp_servicename(snum)) != 0)
+ return False;
if (!get_specific_param(printer, 2, value, &idata, type, &len)) {
free_a_printer(printer, 2);
@@ -677,7 +692,11 @@ static BOOL getprinterdata_printer(const POLICY_HND *handle,
DEBUG(5,("getprinterdata_printer:allocating %d\n", in_size));
- *data = (uint8 *)malloc( in_size *sizeof(uint8) );
+ if((*data = (uint8 *)malloc( in_size *sizeof(uint8) )) == NULL) {
+ free_a_printer(printer, 2);
+ return False;
+ }
+
memset(*data, 0, in_size *sizeof(uint8));
/* copy the min(in_size, len) */
memcpy(*data, idata, (len>in_size)?in_size:len *sizeof(uint8));
@@ -722,7 +741,8 @@ uint32 _spoolss_getprinterdata(const POLICY_HND *handle, UNISTR2 *valuename,
DEBUG(4,("_spoolss_getprinterdata\n"));
if (!OPEN_HANDLE(Printer)) {
- *data=(uint8 *)malloc(4*sizeof(uint8));
+ if((*data=(uint8 *)malloc(4*sizeof(uint8))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
return ERROR_INVALID_HANDLE;
}
@@ -736,7 +756,8 @@ uint32 _spoolss_getprinterdata(const POLICY_HND *handle, UNISTR2 *valuename,
if (found==False) {
DEBUG(5, ("value not found, allocating %d\n", *out_size));
/* reply this param doesn't exist */
- *data=(uint8 *)malloc(*out_size*sizeof(uint8));
+ if((*data=(uint8 *)malloc(*out_size*sizeof(uint8))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
memset(*data, 0x0, *out_size*sizeof(uint8));
return ERROR_INVALID_PARAMETER;
}
@@ -1250,7 +1271,10 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int snum, SPO
if (!search_notify(type, field, &j) )
continue;
- info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA));
+ if((info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
+ free_a_printer(printer, 2);
+ return False;
+ }
current_data=&(info->data[info->count]);
construct_info_data(current_data, type, field, id);
@@ -1297,7 +1321,11 @@ static BOOL construct_notify_jobs_info(print_queue_struct *queue, SPOOL_NOTIFY_I
if (!search_notify(type, field, &j) )
continue;
- info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA));
+ if((info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
+ free_a_printer(printer, 2);
+ return False;
+ }
+
current_data=&(info->data[info->count]);
construct_info_data(current_data, type, field, id);
@@ -1531,7 +1559,8 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum, pstring
/* it's the first time, add it to the list */
if (session_counter==NULL) {
- session_counter=(counter_printer_0 *)malloc(sizeof(counter_printer_0));
+ if((session_counter=(counter_printer_0 *)malloc(sizeof(counter_printer_0))) == NULL)
+ return False;
ZERO_STRUCTP(session_counter);
session_counter->snum=snum;
session_counter->counter=0;
@@ -1635,7 +1664,7 @@ static BOOL construct_printer_info_1(fstring server, uint32 flags, PRINTER_INFO_
/****************************************************************************
****************************************************************************/
-static void construct_dev_mode(DEVICEMODE *devmode, int snum, char *servername)
+static BOOL construct_dev_mode(DEVICEMODE *devmode, int snum, char *servername)
{
char adevice[32];
char aform[32];
@@ -1686,11 +1715,16 @@ static void construct_dev_mode(DEVICEMODE *devmode, int snum, char *servername)
if (ntdevmode->private != NULL)
{
- devmode->private=(uint8 *)malloc(devmode->driverextra*sizeof(uint8));
+ if((devmode->private=(uint8 *)malloc(devmode->driverextra*sizeof(uint8))) == NULL) {
+ free_a_printer(printer, 2);
+ return False;
+ }
memcpy(devmode->private, ntdevmode->private, devmode->driverextra);
}
free_a_printer(printer, 2);
+
+ return True;
}
/********************************************************************
@@ -1749,14 +1783,25 @@ static BOOL construct_printer_info_2(pstring servername, PRINTER_INFO_2 *printer
printer->cjobs = count; /* jobs */
printer->averageppm = ntprinter.info_2->averageppm; /* average pages per minute */
- devmode=(DEVICEMODE *)malloc(sizeof(DEVICEMODE));
+ if((devmode=(DEVICEMODE *)malloc(sizeof(DEVICEMODE))) == NULL)
+ goto err;
+
ZERO_STRUCTP(devmode);
- construct_dev_mode(devmode, snum, servername);
+
+ if(!construct_dev_mode(devmode, snum, servername))
+ goto err;
+
printer->devmode=devmode;
safe_free(queue);
free_a_printer(ntprinter, 2);
return True;
+
+ err:
+
+ safe_free(queue);
+ free_a_printer(ntprinter, 2);
+ return False;
}
/********************************************************************
@@ -1777,7 +1822,10 @@ static BOOL enum_all_printers_info_1(fstring server, uint32 flags, NEW_BUFFER *b
DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
if (construct_printer_info_1(server, flags, &current_prt, snum)) {
- printers=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_1));
+ if((printers=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_1))) == NULL) {
+ *returned=0;
+ return ERROR_NOT_ENOUGH_MEMORY;
+ }
DEBUG(4,("ReAlloced memory for [%d] PRINTER_INFO_1\n", *returned));
memcpy(&(printers[*returned]), &current_prt, sizeof(PRINTER_INFO_1));
(*returned)++;
@@ -1863,7 +1911,8 @@ static BOOL enum_all_printers_info_1_remote(fstring name, NEW_BUFFER *buffer, ui
* We should have a TDB here. The registration is done thru an undocumented RPC call.
*/
- printer=(PRINTER_INFO_1 *)malloc(sizeof(PRINTER_INFO_1));
+ if((printer=(PRINTER_INFO_1 *)malloc(sizeof(PRINTER_INFO_1))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
*returned=1;
@@ -1930,7 +1979,8 @@ static BOOL enum_all_printers_info_2(fstring servername, NEW_BUFFER *buffer, uin
DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
if (construct_printer_info_2(servername, &current_prt, snum)) {
- printers=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_2));
+ if((printers=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_2))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
DEBUG(4,("ReAlloced memory for [%d] PRINTER_INFO_2\n", *returned));
memcpy(&(printers[*returned]), &current_prt, sizeof(PRINTER_INFO_2));
(*returned)++;
@@ -2093,7 +2143,8 @@ static uint32 getprinter_level_0(pstring servername, int snum, NEW_BUFFER *buffe
{
PRINTER_INFO_0 *printer=NULL;
- printer=(PRINTER_INFO_0*)malloc(sizeof(PRINTER_INFO_0));
+ if((printer=(PRINTER_INFO_0*)malloc(sizeof(PRINTER_INFO_0))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
construct_printer_info_0(printer, snum, servername);
@@ -2124,7 +2175,9 @@ static uint32 getprinter_level_1(pstring servername, int snum, NEW_BUFFER *buffe
{
PRINTER_INFO_1 *printer=NULL;
- printer=(PRINTER_INFO_1*)malloc(sizeof(PRINTER_INFO_1));
+ if((printer=(PRINTER_INFO_1*)malloc(sizeof(PRINTER_INFO_1))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
+
construct_printer_info_1(servername, PRINTER_ENUM_ICON8, printer, snum);
/* check the required size. */
@@ -2155,7 +2208,8 @@ static uint32 getprinter_level_2(pstring servername, int snum, NEW_BUFFER *buffe
PRINTER_INFO_2 *printer=NULL;
fstring temp;
- printer=(PRINTER_INFO_2*)malloc(sizeof(PRINTER_INFO_2));
+ if((printer=(PRINTER_INFO_2*)malloc(sizeof(PRINTER_INFO_2)))==NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
fstrcpy(temp, "\\\\");
fstrcat(temp, servername);
@@ -2313,7 +2367,10 @@ static void init_unistr_array(uint16 **uni_array, char **char_array, char *where
for (v=char_array[i]; *v!='\0'; v=char_array[i]) {
snprintf(line, sizeof(line)-1, "%s%s", where, v);
DEBUGADD(6,("%d:%s:%d\n", i, line, strlen(line)));
- *uni_array=Realloc(*uni_array, (j+strlen(line)+2)*sizeof(uint16));
+ if((*uni_array=Realloc(*uni_array, (j+strlen(line)+2)*sizeof(uint16))) == NULL) {
+ DEBUG(0,("init_unistr_array: Realloc error\n" ));
+ return;
+ }
ascii_to_unistr( *uni_array+j, line , strlen(line));
j+=strlen(line)+1;
i++;
@@ -2392,7 +2449,8 @@ static uint32 getprinterdriver2_level1(pstring servername, pstring architecture,
{
DRIVER_INFO_1 *info=NULL;
- info=(DRIVER_INFO_1 *)malloc(sizeof(DRIVER_INFO_1));
+ if((info=(DRIVER_INFO_1 *)malloc(sizeof(DRIVER_INFO_1))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
construct_printer_driver_info_1(info, snum, servername, architecture);
@@ -2422,7 +2480,8 @@ static uint32 getprinterdriver2_level2(pstring servername, pstring architecture,
{
DRIVER_INFO_2 *info=NULL;
- info=(DRIVER_INFO_2 *)malloc(sizeof(DRIVER_INFO_2));
+ if((info=(DRIVER_INFO_2 *)malloc(sizeof(DRIVER_INFO_2))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
construct_printer_driver_info_2(info, snum, servername, architecture);
@@ -2452,7 +2511,8 @@ static uint32 getprinterdriver2_level3(pstring servername, pstring architecture,
{
DRIVER_INFO_3 *info=NULL;
- info=(DRIVER_INFO_3 *)malloc(sizeof(DRIVER_INFO_3));
+ if((info=(DRIVER_INFO_3 *)malloc(sizeof(DRIVER_INFO_3)))==NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
construct_printer_driver_info_3(info, snum, servername, architecture);
@@ -2971,9 +3031,16 @@ static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue,
job_info->timeelapsed=0;
job_info->pagesprinted=0;
- devmode=(DEVICEMODE *)malloc(sizeof(DEVICEMODE));
+ if((devmode=(DEVICEMODE *)malloc(sizeof(DEVICEMODE))) == NULL) {
+ free_a_printer(ntprinter, 2);
+ return False;
+ }
+
ZERO_STRUCTP(devmode);
- construct_dev_mode(devmode, snum, global_myname);
+ if(!construct_dev_mode(devmode, snum, global_myname)) {
+ free_a_printer(ntprinter, 2);
+ return False;
+ }
job_info->devmode=devmode;
free_a_printer(ntprinter, 2);
@@ -3189,7 +3256,9 @@ static uint32 enumprinterdrivers_level1(fstring *list, fstring servername, fstri
int i;
NT_PRINTER_DRIVER_INFO_LEVEL driver;
DRIVER_INFO_1 *driver_info_1=NULL;
- driver_info_1=(DRIVER_INFO_1 *)malloc(*returned * sizeof(DRIVER_INFO_1));
+
+ if((driver_info_1=(DRIVER_INFO_1 *)malloc(*returned * sizeof(DRIVER_INFO_1))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
for (i=0; i<*returned; i++) {
get_a_printer_driver(&driver, 3, list[i], architecture);
@@ -3234,7 +3303,9 @@ static uint32 enumprinterdrivers_level2(fstring *list, fstring servername, fstri
int i;
NT_PRINTER_DRIVER_INFO_LEVEL driver;
DRIVER_INFO_2 *driver_info_2=NULL;
- driver_info_2=(DRIVER_INFO_2 *)malloc(*returned * sizeof(DRIVER_INFO_2));
+
+ if((driver_info_2=(DRIVER_INFO_2 *)malloc(*returned * sizeof(DRIVER_INFO_2))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
for (i=0; i<*returned; i++) {
get_a_printer_driver(&driver, 3, list[i], architecture);
@@ -3279,7 +3350,9 @@ static uint32 enumprinterdrivers_level3(fstring *list, fstring servername, fstri
int i;
NT_PRINTER_DRIVER_INFO_LEVEL driver;
DRIVER_INFO_3 *driver_info_3=NULL;
- driver_info_3=(DRIVER_INFO_3 *)malloc((*returned)*sizeof(DRIVER_INFO_3));
+
+ if((driver_info_3=(DRIVER_INFO_3 *)malloc((*returned)*sizeof(DRIVER_INFO_3))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
for (i=0; i<*returned; i++) {
get_a_printer_driver(&driver, 3, list[i], architecture);
@@ -3340,6 +3413,9 @@ uint32 _spoolss_enumprinterdrivers( UNISTR2 *name, UNISTR2 *environment, uint32
*returned=get_ntdrivers(&list, architecture);
DEBUGADD(4,("we have: [%d] drivers in environment [%s]\n", *returned, architecture));
+ if(*returned == -1)
+ return ERROR_NOT_ENOUGH_MEMORY;
+
for (i=0; i<*returned; i++)
DEBUGADD(5,("driver: [%s]\n", list[i]));
@@ -3393,7 +3469,10 @@ uint32 _new_spoolss_enumforms( const POLICY_HND *handle, uint32 level,
switch (level) {
case 1:
- forms_1=(FORM_1 *)malloc(*numofforms * sizeof(FORM_1));
+ if((forms_1=(FORM_1 *)malloc(*numofforms * sizeof(FORM_1))) == NULL) {
+ *numofforms=0;
+ return ERROR_NOT_ENOUGH_MEMORY;
+ }
/* construct the list of form structures */
for (i=0; i<*numofforms; i++) {
@@ -3472,7 +3551,8 @@ static uint32 enumports_level_1(NEW_BUFFER *buffer, uint32 offered, uint32 *need
if ( lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) )
(*returned)++;
- ports=(PORT_INFO_1 *)malloc( (*returned+1) * sizeof(PORT_INFO_1) );
+ if((ports=(PORT_INFO_1 *)malloc( (*returned+1) * sizeof(PORT_INFO_1) )) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
for (snum=0; snum<n_services; snum++) {
if ( lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) ) {
@@ -3525,7 +3605,8 @@ static uint32 enumports_level_2(NEW_BUFFER *buffer, uint32 offered, uint32 *need
if ( lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) )
(*returned)++;
- ports=(PORT_INFO_2 *)malloc( (*returned+1) * sizeof(PORT_INFO_2) );
+ if((ports=(PORT_INFO_2 *)malloc( (*returned+1) * sizeof(PORT_INFO_2) )) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
for (snum=0; snum<n_services; snum++) {
if ( lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) ) {
@@ -3691,7 +3772,8 @@ static uint32 getprinterdriverdir_level_1(UNISTR2 *name, UNISTR2 *uni_environmen
pstring short_archi;
DRIVER_DIRECTORY_1 *info=NULL;
- info=(DRIVER_DIRECTORY_1 *)malloc(sizeof(DRIVER_DIRECTORY_1));
+ if((info=(DRIVER_DIRECTORY_1 *)malloc(sizeof(DRIVER_DIRECTORY_1))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
unistr2_to_ascii(long_archi, uni_environment, sizeof(long_archi)-1);
get_short_archi(short_archi, long_archi);
@@ -3822,9 +3904,10 @@ uint32 _spoolss_enumprinterdata(const POLICY_HND *handle, uint32 idx,
if (!get_specific_param_by_index(printer, 2, idx, value, &data, &type, &data_len)) {
free_a_printer(printer, 2);
+ safe_free(data);
return ERROR_NO_MORE_ITEMS;
}
-
+
/*
* the value is:
* - counted in bytes in the request
@@ -3835,7 +3918,11 @@ uint32 _spoolss_enumprinterdata(const POLICY_HND *handle, uint32 idx,
*/
*out_max_value_len=in_value_len/2;
- *out_value=(uint16 *)malloc(in_value_len*sizeof(uint8));
+ if((*out_value=(uint16 *)malloc(in_value_len*sizeof(uint8))) == NULL) {
+ free_a_printer(printer, 2);
+ safe_free(data);
+ return ERROR_NOT_ENOUGH_MEMORY;
+ }
ascii_to_unistr(*out_value, value, *out_max_value_len);
*out_value_len=2*(1+strlen(value));
@@ -3843,7 +3930,11 @@ uint32 _spoolss_enumprinterdata(const POLICY_HND *handle, uint32 idx,
/* the data is counted in bytes */
*out_max_data_len=in_data_len;
- *data_out=(uint8 *)malloc(in_data_len*sizeof(uint8));
+ if((*data_out=(uint8 *)malloc(in_data_len*sizeof(uint8))) == NULL) {
+ free_a_printer(printer, 2);
+ safe_free(data);
+ return ERROR_NOT_ENOUGH_MEMORY;
+ }
memcpy(*data_out, data, data_len);
*out_data_len=data_len;
@@ -3912,7 +4003,8 @@ uint32 _spoolss_addform( const POLICY_HND *handle,
return ERROR_INVALID_HANDLE;
count=get_ntforms(&list);
- add_a_form(&list, form, &count);
+ if(!add_a_form(&list, form, &count))
+ return ERROR_NOT_ENOUGH_MEMORY;
write_ntforms(&list, count);
safe_free(list);
@@ -3953,7 +4045,9 @@ static uint32 enumprintprocessors_level_1(NEW_BUFFER *buffer, uint32 offered, ui
{
PRINTPROCESSOR_1 *info_1=NULL;
- info_1 = (PRINTPROCESSOR_1 *)malloc(sizeof(PRINTPROCESSOR_1));
+ if((info_1 = (PRINTPROCESSOR_1 *)malloc(sizeof(PRINTPROCESSOR_1))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
+
(*returned) = 0x1;
init_unistr(&(info_1->name), "winprint");
@@ -4010,7 +4104,9 @@ static uint32 enumprintprocdatatypes_level_1(NEW_BUFFER *buffer, uint32 offered,
{
PRINTPROCDATATYPE_1 *info_1=NULL;
- info_1 = (PRINTPROCDATATYPE_1 *)malloc(sizeof(PRINTPROCDATATYPE_1));
+ if((info_1 = (PRINTPROCDATATYPE_1 *)malloc(sizeof(PRINTPROCDATATYPE_1))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
+
(*returned) = 0x1;
init_unistr(&(info_1->name), "RAW");
@@ -4060,7 +4156,9 @@ static uint32 enumprintmonitors_level_1(NEW_BUFFER *buffer, uint32 offered, uint
{
PRINTMONITOR_1 *info_1=NULL;
- info_1 = (PRINTMONITOR_1 *)malloc(sizeof(PRINTMONITOR_1));
+ if((info_1 = (PRINTMONITOR_1 *)malloc(sizeof(PRINTMONITOR_1))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
+
(*returned) = 0x1;
init_unistr(&(info_1->name), "Local Port");
@@ -4089,7 +4187,9 @@ static uint32 enumprintmonitors_level_2(NEW_BUFFER *buffer, uint32 offered, uint
{
PRINTMONITOR_2 *info_2=NULL;
- info_2 = (PRINTMONITOR_2 *)malloc(sizeof(PRINTMONITOR_2));
+ if((info_2 = (PRINTMONITOR_2 *)malloc(sizeof(PRINTMONITOR_2))) == NULL)
+ return ERROR_NOT_ENOUGH_MEMORY;
+
(*returned) = 0x1;
init_unistr(&(info_2->name), "Local Port");
@@ -4151,6 +4251,7 @@ static uint32 getjob_level_1(print_queue_struct *queue, int count, int snum, uin
int i=0;
BOOL found=False;
JOB_INFO_1 *info_1=NULL;
+
info_1=(JOB_INFO_1 *)malloc(sizeof(JOB_INFO_1));
if (info_1 == NULL) {
generated by cgit (git 2.34.1) at 2024-07-10 07:34:20 +0000