3 files changed, 62 insertions, 21 deletions

diff --git a/source3/rpc_parse/parse_misc.c b/source3/rpc_parse/parse_misc.c
index 859a800771..0a2f49d4dd 100644
--- a/source3/rpc_parse/parse_misc.c
+++ b/source3/rpc_parse/parse_misc.c
@@ -647,17 +647,14 @@ BOOL smb_io_buffer5(char *desc, BUFFER5 *buf5, prs_struct *ps, int depth)
 
 	if (buf5 == NULL) return False;
 
-	prs_align(ps);
-	prs_uint32("buf_len", ps, depth, &(buf5->buf_len));
+	if(!prs_align(ps))
+		return False;
+	if(!prs_uint32("buf_len", ps, depth, &buf5->buf_len))
+		return False;
 
-	/* reading: alloc the buffer first */
-	if ( UNMARSHALLING(ps) ) {
-		buf5->buffer=(uint16 *)prs_alloc_mem(ps, sizeof(uint16)*buf5->buf_len );
-		if (buf5->buffer == NULL)
-			return False;
-	}
-	
-	prs_uint16s(True, "buffer", ps, depth, buf5->buffer, buf5->buf_len);
+
+	if(!prs_buffer5(True, "buffer" , ps, depth, buf5))
+		return False;
 
 	return True;
 }
diff --git a/source3/rpc_parse/parse_prs.c b/source3/rpc_parse/parse_prs.c
index e800c20290..5621a2c210 100644
--- a/source3/rpc_parse/parse_prs.c
+++ b/source3/rpc_parse/parse_prs.c
@@ -563,6 +563,47 @@ BOOL prs_uint32s(BOOL charmode, char *name, prs_struct *ps, int depth, uint32 *d
 }
 
 /******************************************************************
+ Stream an array of unicode string, length/buffer specified separately,
+ in uint16 chars. We use DBG_RW_PCVAL, not DBG_RW_PSVAL here
+ as the unicode string is already in little-endian format.
+ ********************************************************************/
+
+BOOL prs_buffer5(BOOL charmode, char *name, prs_struct *ps, int depth, BUFFER5 *str)
+{
+	char *p;
+	char *q = prs_mem_get(ps, str->buf_len * sizeof(uint16));
+	if (q == NULL)
+		return False;
+
+	if (UNMARSHALLING(ps)) {
+		str->buffer = (uint16 *)prs_alloc_mem(ps,str->buf_len * sizeof(uint16));
+		if (str->buffer == NULL)
+			return False;
+		memset(str->buffer, '\0', str->buf_len * sizeof(uint16));
+	}
+
+	/* If the string is empty, we don't have anything to stream */
+	if (str->buf_len==0)
+		return True;
+
+	p = (char *)str->buffer;
+
+	/* If we're using big-endian, reverse to get little-endian. */
+	if(ps->bigendian_data) {
+		DBG_RW_PSVAL(charmode, name, depth, ps->data_offset, 
+			     ps->io, ps->bigendian_data, q, p, 
+			     str->buf_len)
+	} else {
+		DBG_RW_PCVAL(charmode, name, depth, ps->data_offset, 
+			     ps->io, q, p, str->buf_len * sizeof(uint16))
+	}
+	
+	ps->data_offset += (str->buf_len * sizeof(uint16));
+
+	return True;
+}
+
+/******************************************************************
  Stream a "not" unicode string, length/buffer specified separately,
  in byte chars. String is in little-endian format.
  ********************************************************************/
diff --git a/source3/rpc_parse/parse_samr.c b/source3/rpc_parse/parse_samr.c
index c36ca06aae..aa08606a57 100644
--- a/source3/rpc_parse/parse_samr.c
+++ b/source3/rpc_parse/parse_samr.c
@@ -3890,22 +3890,25 @@ BOOL samr_io_r_chgpasswd_user(char *desc, SAMR_R_CHGPASSWD_USER *r_u, prs_struct
  **********************************************************************/
 BOOL samr_io_q_lookup_domain(char* desc, SAMR_Q_LOOKUP_DOMAIN* q_u, prs_struct *ps, int depth)
 {
-  if (q_u == NULL)
-    return False;
+	if (q_u == NULL)
+		return False;
 
-  prs_debug(ps, depth, desc, "samr_io_q_lookup_domain");
-  depth++;
+	prs_debug(ps, depth, desc, "samr_io_q_lookup_domain");
+	depth++;
+
+	if(!prs_align(ps))
+		return False;
 
-  prs_align(ps);
+	if(!smb_io_pol_hnd("connect_pol", &q_u->connect_pol, ps, depth))
+		return False;
 
-  smb_io_pol_hnd("connect_pol", &(q_u->connect_pol), ps, depth);
+	if(!smb_io_unihdr("hdr_domain", &q_u->hdr_domain, ps, depth))
+		return False;
 
-  smb_io_unihdr("hdr_domain", &(q_u->hdr_domain), ps, depth);
-  smb_io_unistr2("uni_domain", &(q_u->uni_domain),
-		 q_u->hdr_domain.buffer, ps, depth);
-  prs_align(ps);
+	if(!smb_io_unistr2("uni_domain", &q_u->uni_domain, q_u->hdr_domain.buffer, ps, depth))
+		return False;
 
-  return True;
+	return True;
 } 
 
 /*******************************************************************