1 files changed, 16 insertions, 9 deletions

diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index 6f46b4bc42..c7b4df9d82 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -566,33 +566,39 @@ static void srv_spoolss_receive_message(int msg_type, pid_t src, void *buf, size
 {
 	Printer_entry *find_printer;
 	WERROR status;
+	fstring printer_name;
 	char msg[8];
+	char *buf_ptr = (char *)buf;
 	uint32 low, high;
 
-	if (len != sizeof(msg)) {
+	if (len < sizeof(msg) + 2) {
 		DEBUG(2,("srv_spoolss_receive_message: got incorrect message size (%u)!\n", (unsigned int)len));
 		return;
 	}
 
-	memcpy(msg, buf, len);
+	memcpy(msg, buf_ptr, sizeof(msg));
 	low = IVAL(msg,0);
 	high = IVAL(msg,4);
+	fstrcpy(printer_name, buf_ptr + sizeof(msg));
 
-	DEBUG(10,("srv_spoolss_receive_message: Got message printer change low=0x%x  high=0x%x\n", (unsigned int)low,
-		(unsigned int)high ));
-
-	find_printer = printers_list;
+	DEBUG(10,("srv_spoolss_receive_message: Got message printer change name [%s] low=0x%x  high=0x%x\n",
+		printer_name, (unsigned int)low, (unsigned int)high ));
 
 	/* Iterate the printer list */
-	for(; find_printer; find_printer = find_printer->next) {
+	for(find_printer = printers_list; find_printer; find_printer = find_printer->next) {
 
 		/*
 		 * If the entry has a connected client we send the message.
 		 */
 
-
 		if (find_printer->notify.client_connected==True) {
 			DEBUG(10,("srv_spoolss_receive_message: printerserver [%s]\n", find_printer->dev.printerservername ));
+			if (*printer_name && !strequal(printer_name, find_printer->dev.handlename)) {
+				DEBUG(10,("srv_spoolss_receive_message: ignoring message sent to %s [%s]\n",
+					printer_name, find_printer->dev.handlename ));
+				continue;
+			}
+
 			if (cli_spoolss_reply_rrpcn(&cli, &find_printer->notify.client_hnd, low, high, &status))
 				DEBUG(10,("srv_spoolss_receive_message: cli_spoolss_reply_rrpcn status = 0x%x\n",
 					(unsigned int)W_ERROR_V(status)));
@@ -608,8 +614,9 @@ static void srv_spoolss_receive_message(int msg_type, pid_t src, void *buf, size
 
 static BOOL srv_spoolss_sendnotify(uint32 high, uint32 low)
 {
-	char msg[8];
+	char msg[10];
 
+	ZERO_STRUCT(msg);
 	SIVAL(msg,0,low);
 	SIVAL(msg,4,high);
 	DEBUG(10,("srv_spoolss_sendnotify: printer change low=0x%x  high=0x%x\n", low, high));