1 files changed, 27 insertions, 11 deletions

diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index a756eb64cc..a97ecdecaf 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -8685,11 +8685,29 @@ WERROR _spoolss_GetPrinterDataEx(pipes_struct *p,
 
 	if (Printer->printer_type == SPLHND_SERVER) {
 
+		union spoolss_PrinterData data;
+
 		result = getprinterdata_printer_server(p->mem_ctx,
 						       r->in.value_name,
 						       r->out.type,
-						       r->out.data);
-		goto done;
+						       &data);
+		if (!W_ERROR_IS_OK(result)) {
+			goto done;
+		}
+
+		result = push_spoolss_PrinterData(p->mem_ctx, &blob,
+						  *r->out.type, &data);
+		if (!W_ERROR_IS_OK(result)) {
+			goto done;
+		}
+
+		*r->out.needed = blob.length;
+
+		if (r->in.offered >= *r->out.needed) {
+			memcpy(r->out.data, blob.data, blob.length);
+		}
+
+		return SPOOLSS_BUFFER_OK(WERR_OK, WERR_MORE_DATA);
 	}
 
 	if (!get_printer_snum(p, r->in.handle, &snum, NULL)) {
@@ -8714,8 +8732,10 @@ WERROR _spoolss_GetPrinterDataEx(pipes_struct *p,
 	    strequal(r->in.value_name, "ChangeId")) {
 		*r->out.type = REG_DWORD;
 		*r->out.needed = 4;
-		r->out.data->value = printer->info_2->changeid;
-		result = WERR_OK;
+		if (r->in.offered >= *r->out.needed) {
+			SIVAL(r->out.data, 0, printer->info_2->changeid);
+			result = WERR_OK;
+		}
 		goto done;
 	}
 
@@ -8736,12 +8756,9 @@ WERROR _spoolss_GetPrinterDataEx(pipes_struct *p,
 	*r->out.needed = regval_size(val);
 	*r->out.type = regval_type(val);
 
-	blob = data_blob_const(regval_data_p(val), regval_size(val));
-
-	result = pull_spoolss_PrinterData(p->mem_ctx, &blob,
-					  r->out.data,
-					  *r->out.type);
-
+	if (r->in.offered >= *r->out.needed) {
+		memcpy(r->out.data, regval_data_p(val), regval_size(val));
+	}
  done:
 	if (printer) {
 		free_a_printer(&printer, 2);
@@ -8751,7 +8768,6 @@ WERROR _spoolss_GetPrinterDataEx(pipes_struct *p,
 		return result;
 	}
 
-	*r->out.needed  = ndr_size_spoolss_PrinterData(r->out.data, *r->out.type, NULL, 0);
 	*r->out.type    = SPOOLSS_BUFFER_OK(*r->out.type, REG_NONE);
 	r->out.data     = SPOOLSS_BUFFER_OK(r->out.data, r->out.data);