1 files changed, 61 insertions, 40 deletions

diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index cdddb8b564..6f46b4bc42 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -4868,7 +4868,8 @@ static void fill_job_info_1(JOB_INFO_1 *job_info, print_queue_struct *queue,
 ****************************************************************************/
 static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue,
                             int position, int snum, 
-			    NT_PRINTER_INFO_LEVEL *ntprinter)
+			    NT_PRINTER_INFO_LEVEL *ntprinter, 
+			    DEVICEMODE *devmode)
 {
 	pstring temp_name;
 	pstring chaine;
@@ -4906,9 +4907,7 @@ static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue,
 	job_info->timeelapsed=0;
 	job_info->pagesprinted=0;
 
-	if((job_info->devmode = construct_dev_mode(snum)) == NULL) {
-		return False;
-	}
+	job_info->devmode = devmode;
 
 	return (True);
 }
@@ -4967,24 +4966,33 @@ static WERROR enumjobs_level2(print_queue_struct *queue, int snum,
 			      uint32 *needed, uint32 *returned)
 {
 	NT_PRINTER_INFO_LEVEL *ntprinter = NULL;
-	JOB_INFO_2 *info;
+	JOB_INFO_2 *info = NULL;
 	int i;
 	WERROR result;
+	DEVICEMODE *devmode = NULL;
 	
 	info=(JOB_INFO_2 *)malloc(*returned*sizeof(JOB_INFO_2));
 	if (info==NULL) {
 		*returned=0;
-		return WERR_NOMEM;
+		result = WERR_NOMEM;
+		goto done;
 	}
 
 	result = get_a_printer(&ntprinter, 2, lp_servicename(snum));
 	if (!W_ERROR_IS_OK(result)) {
 		*returned = 0;
-		return result;
+		goto done;
 	}
-		
+
+	if (!(devmode = construct_dev_mode(snum))) {
+		*returned = 0;
+		result = WERR_NOMEM;
+		goto done;
+	}
+
 	for (i=0; i<*returned; i++)
-		fill_job_info_2(&(info[i]), &queue[i], i, snum, ntprinter);
+		fill_job_info_2(&(info[i]), &queue[i], i, snum, ntprinter,
+				devmode);
 
 	free_a_printer(&ntprinter, 2);
 	SAFE_FREE(queue);
@@ -4993,27 +5001,30 @@ static WERROR enumjobs_level2(print_queue_struct *queue, int snum,
 	for (i=0; i<*returned; i++)
 		(*needed) += spoolss_size_job_info_2(&info[i]);
 
+	if (*needed > offered) {
+		*returned=0;
+		result = WERR_INSUFFICIENT_BUFFER;
+		goto done;
+	}
+
 	if (!alloc_buffer_size(buffer, *needed)) {
-		SAFE_FREE(info);
-		return WERR_INSUFFICIENT_BUFFER;
+		result = WERR_INSUFFICIENT_BUFFER;
+		goto done;
 	}
 
 	/* fill the buffer with the structures */
 	for (i=0; i<*returned; i++)
 		smb_io_job_info_2("", buffer, &info[i], 0);	
 
-	/* clear memory */
-	for (i = 0; i < *returned; i++)
-		free_job_info_2(&info[i]);
+	result = WERR_OK;
 
+ done:
+	free_a_printer(&ntprinter, 2);
+	free_devmode(devmode);
+	SAFE_FREE(queue);
 	SAFE_FREE(info);
 
-	if (*needed > offered) {
-		*returned=0;
-		return WERR_INSUFFICIENT_BUFFER;
-	}
-
-	return WERR_OK;
+	return result;
 }
 
 /****************************************************************************
@@ -6918,14 +6929,15 @@ static WERROR getjob_level_2(print_queue_struct *queue, int count, int snum, uin
 	JOB_INFO_2 *info_2;
 	NT_PRINTER_INFO_LEVEL *ntprinter = NULL;
 	WERROR ret;
+	DEVICEMODE *devmode = NULL;
 
 	info_2=(JOB_INFO_2 *)malloc(sizeof(JOB_INFO_2));
 
 	ZERO_STRUCTP(info_2);
 
 	if (info_2 == NULL) {
-		SAFE_FREE(queue);
-		return WERR_NOMEM;
+		ret = WERR_NOMEM;
+		goto done;
 	}
 
 	for (i=0; i<count && found==False; i++) {
@@ -6934,39 +6946,48 @@ static WERROR getjob_level_2(print_queue_struct *queue, int count, int snum, uin
 	}
 	
 	if (found==False) {
-		SAFE_FREE(queue);
-		SAFE_FREE(info_2);
-		/* NT treats not found as bad param... yet another bad choice */
-		return WERR_INVALID_PARAM;
+		/* NT treats not found as bad param... yet another bad
+		   choice */
+		ret = WERR_INVALID_PARAM;
+		goto done;
 	}
 	
 	ret = get_a_printer(&ntprinter, 2, lp_servicename(snum));
-	if (!W_ERROR_IS_OK(ret)) {
-		SAFE_FREE(queue);
-		return ret;
+	if (!W_ERROR_IS_OK(ret))
+		goto done;
+
+	if (construct_dev_mode(snum) == NULL) {
+		ret = WERR_NOMEM;
+		goto done;
 	}
 
-	fill_job_info_2(info_2, &(queue[i-1]), i, snum, ntprinter);
-	
-	free_a_printer(&ntprinter, 2);
-	SAFE_FREE(queue);
+	fill_job_info_2(info_2, &(queue[i-1]), i, snum, ntprinter, devmode);
 	
 	*needed += spoolss_size_job_info_2(info_2);
 
 	if (!alloc_buffer_size(buffer, *needed)) {
-		SAFE_FREE(info_2);
-		return WERR_INSUFFICIENT_BUFFER;
+		ret = WERR_INSUFFICIENT_BUFFER;
+		goto done;
 	}
 
 	smb_io_job_info_2("", buffer, info_2, 0);
 
-	free_job_info_2(info_2);
-	SAFE_FREE(info_2);
+	if (*needed > offered) {
+		ret = WERR_INSUFFICIENT_BUFFER;
+		goto done;
+	}
 
-	if (*needed > offered)
-		return WERR_INSUFFICIENT_BUFFER;
+	ret = WERR_OK;
+	
+ done:
+	/* Cleanup allocated memory */
 
-	return WERR_OK;
+	SAFE_FREE(queue);
+	free_job_info_2(info_2);	/* Also frees devmode */
+	SAFE_FREE(info_2);
+	free_a_printer(&ntprinter, 2);
+	
+	return ret;
 }
 
 /****************************************************************************