2 files changed, 130 insertions, 202 deletions

diff --git a/source3/rpc_server/srv_reg_nt.c b/source3/rpc_server/srv_reg_nt.c
index feb89be542..8b861f8431 100644
--- a/source3/rpc_server/srv_reg_nt.c
+++ b/source3/rpc_server/srv_reg_nt.c
@@ -125,7 +125,7 @@ static WERROR open_registry_key(pipes_struct *p, POLICY_HND *hnd, REGISTRY_KEY *
 {
 	REGISTRY_KEY 	*regkey = NULL;
 	WERROR     	result = WERR_OK;
-	REGSUBKEY_CTR	subkeys;
+	REGSUBKEY_CTR	*subkeys = NULL;
 	pstring		subkeyname2;
 	int		subkey_len;
 	
@@ -167,21 +167,25 @@ static WERROR open_registry_key(pipes_struct *p, POLICY_HND *hnd, REGISTRY_KEY *
 	if ( !(regkey->hook = reghook_cache_find( regkey->name )) ) {
 		DEBUG(0,("open_registry_key: Failed to assigned a REGISTRY_HOOK to [%s]\n",
 			regkey->name ));
-		return WERR_BADFILE;
+		result = WERR_BADFILE;
+		goto done;
 	}
 	
 	/* check if the path really exists; failed is indicated by -1 */
 	/* if the subkey count failed, bail out */
 
-	regsubkey_ctr_init( &subkeys );
-	
-	if ( fetch_reg_keys( regkey, &subkeys ) == -1 )  {
+	if ( !(subkeys = TALLOC_ZERO_P( p->mem_ctx, REGSUBKEY_CTR )) ) {
+		result = WERR_NOMEM;
+		goto done;
+	}
+
+	if ( fetch_reg_keys( regkey, subkeys ) == -1 )  {
 		result = WERR_BADFILE;
 		goto done;
 	}
 		
 	if ( !create_policy_hnd( p, hnd, free_regkey_info, regkey ) ) {
-			result = WERR_BADFILE; 
+		result = WERR_BADFILE; 
 		goto done;
 	}
 	
@@ -192,7 +196,7 @@ static WERROR open_registry_key(pipes_struct *p, POLICY_HND *hnd, REGISTRY_KEY *
 done:
 	/* clean up */
 
-	regsubkey_ctr_destroy( &subkeys );
+	TALLOC_FREE( subkeys );
 	
 	if ( ! NT_STATUS_IS_OK(result) )
 		SAFE_FREE( regkey );
@@ -229,31 +233,32 @@ static BOOL get_subkey_information( REGISTRY_KEY *key, uint32 *maxnum, uint32 *m
 {
 	int 		num_subkeys, i;
 	uint32 		max_len;
-	REGSUBKEY_CTR 	subkeys;
+	REGSUBKEY_CTR 	*subkeys;
 	uint32 		len;
 	
 	if ( !key )
 		return False;
 
-	regsubkey_ctr_init( &subkeys );	
-	   
-	if ( fetch_reg_keys( key, &subkeys ) == -1 )
+	if ( !(subkeys = TALLOC_ZERO_P( NULL, REGSUBKEY_CTR )) )
+		return False;
+
+	if ( fetch_reg_keys( key, subkeys ) == -1 )
 		return False;
 
 	/* find the longest string */
 	
 	max_len = 0;
-	num_subkeys = regsubkey_ctr_numkeys( &subkeys );
+	num_subkeys = regsubkey_ctr_numkeys( subkeys );
 	
 	for ( i=0; i<num_subkeys; i++ ) {
-		len = strlen( regsubkey_ctr_specific_key(&subkeys, i) );
+		len = strlen( regsubkey_ctr_specific_key(subkeys, i) );
 		max_len = MAX(max_len, len);
 	}
 
 	*maxnum = num_subkeys;
 	*maxlen = max_len*2;
 	
-	regsubkey_ctr_destroy( &subkeys );
+	TALLOC_FREE( subkeys );
 	
 	return True;
 }
@@ -265,7 +270,7 @@ static BOOL get_subkey_information( REGISTRY_KEY *key, uint32 *maxnum, uint32 *m
 static BOOL get_value_information( REGISTRY_KEY *key, uint32 *maxnum, 
                                     uint32 *maxlen, uint32 *maxsize )
 {
-	REGVAL_CTR 	values;
+	REGVAL_CTR 	*values;
 	REGISTRY_VALUE	*val;
 	uint32 		sizemax, lenmax;
 	int 		i, num_values;
@@ -273,29 +278,30 @@ static BOOL get_value_information( REGISTRY_KEY *key, uint32 *maxnum,
 	if ( !key )
 		return False;
 
-	regval_ctr_init( &values );
+	if ( !(values = TALLOC_ZERO_P( NULL, REGVAL_CTR )) )
+		return False;
 	
-	if ( fetch_reg_values( key, &values ) == -1 )
+	if ( fetch_reg_values( key, values ) == -1 )
 		return False;
 	
 	lenmax = sizemax = 0;
-	num_values = regval_ctr_numvals( &values );
+	num_values = regval_ctr_numvals( values );
 	
-	val = regval_ctr_specific_value( &values, 0 );
+	val = regval_ctr_specific_value( values, 0 );
 	
 	for ( i=0; i<num_values && val; i++ ) 
 	{
 		lenmax  = MAX(lenmax,  val->valuename ? strlen(val->valuename)+1 : 0 );
 		sizemax = MAX(sizemax, val->size );
 		
-		val = regval_ctr_specific_value( &values, i );
+		val = regval_ctr_specific_value( values, i );
 	}
 
 	*maxnum   = num_values;
 	*maxlen   = lenmax;
 	*maxsize  = sizemax;
 	
-	regval_ctr_destroy( &values );
+	TALLOC_FREE( values );
 	
 	return True;
 }
@@ -400,7 +406,7 @@ WERROR _reg_open_entry(pipes_struct *p, REG_Q_OPEN_ENTRY *q_u, REG_R_OPEN_ENTRY
 	
 	/* check granted access first; what is the correct mask here? */
 
-	if ( !(parent->access_granted & (SEC_RIGHTS_ENUM_SUBKEYS|SEC_RIGHTS_CREATE_SUBKEY)) )
+	if ( !(parent->access_granted & (SEC_RIGHTS_ENUM_SUBKEYS|SEC_RIGHTS_CREATE_SUBKEY|SEC_RIGHTS_QUERY_VALUE|SEC_RIGHTS_SET_VALUE)) )
 		return WERR_ACCESS_DENIED;
 	
 	/* open the key first to get the appropriate REGISTRY_HOOK 
@@ -435,7 +441,7 @@ WERROR _reg_query_value(pipes_struct *p, REG_Q_QUERY_VALUE *q_u, REG_R_QUERY_VAL
 	fstring 		name;
 	REGISTRY_KEY 		*regkey = find_regkey_index_by_hnd( p, &q_u->pol );
 	REGISTRY_VALUE		*val = NULL;
-	REGVAL_CTR		regvals;
+	REGVAL_CTR		*regvals;
 	int			i;
 
 	if ( !regkey )
@@ -447,7 +453,8 @@ WERROR _reg_query_value(pipes_struct *p, REG_Q_QUERY_VALUE *q_u, REG_R_QUERY_VAL
 
 	DEBUG(5,("reg_info: looking up value: [%s]\n", name));
 
-	regval_ctr_init( &regvals );
+	if ( !(regvals = TALLOC_P( p->mem_ctx, REGVAL_CTR )) ) 
+		return WERR_NOMEM;
 	
 	for ( i=0; fetch_reg_values_specific(regkey, &val, i); i++ ) 
 	{
@@ -463,7 +470,7 @@ WERROR _reg_query_value(pipes_struct *p, REG_Q_QUERY_VALUE *q_u, REG_R_QUERY_VAL
 
 	init_reg_r_query_value(q_u->ptr_buf, r_u, val, status);
 	
-	regval_ctr_destroy( &regvals );
+	TALLOC_FREE( regvals );
 	free_registry_value( val );
 
 	return status;
@@ -774,8 +781,8 @@ static WERROR reg_load_tree( REGF_FILE *regfile, const char *topkeypath,
 {
 	REGF_NK_REC *subkey;
 	REGISTRY_KEY registry_key;
-	REGVAL_CTR values;
-	REGSUBKEY_CTR subkeys;
+	REGVAL_CTR *values;
+	REGSUBKEY_CTR *subkeys;
 	int i;
 	pstring path;
 	WERROR result = WERR_OK;
@@ -791,13 +798,16 @@ static WERROR reg_load_tree( REGF_FILE *regfile, const char *topkeypath,
 	
 	/* now start parsing the values and subkeys */
 
-	regsubkey_ctr_init( &subkeys );
-	regval_ctr_init( &values );
+	if ( !(subkeys = TALLOC_ZERO_P( regfile->mem_ctx, REGSUBKEY_CTR )) )
+		return WERR_NOMEM;
 	
+	if ( !(values = TALLOC_ZERO_P( subkeys, REGVAL_CTR )) )
+		return WERR_NOMEM;
+
 	/* copy values into the REGVAL_CTR */
 	
 	for ( i=0; i<key->num_values; i++ ) {
-		regval_ctr_addvalue( &values, key->values[i].valuename, key->values[i].type,
+		regval_ctr_addvalue( values, key->values[i].valuename, key->values[i].type,
 			key->values[i].data, (key->values[i].data_size & ~VK_DATA_IN_OFFSET) );
 	}
 
@@ -805,20 +815,19 @@ static WERROR reg_load_tree( REGF_FILE *regfile, const char *topkeypath,
 	
 	key->subkey_index = 0;
 	while ( (subkey = regfio_fetch_subkey( regfile, key )) ) {
-		regsubkey_ctr_addkey( &subkeys, subkey->keyname );
+		regsubkey_ctr_addkey( subkeys, subkey->keyname );
 	}
 	
 	/* write this key and values out */
 	
-	if ( !store_reg_values( &registry_key, &values ) 
-		|| !store_reg_keys( &registry_key, &subkeys ) )
+	if ( !store_reg_values( &registry_key, values ) 
+		|| !store_reg_keys( &registry_key, subkeys ) )
 	{
 		DEBUG(0,("reg_load_tree: Failed to load %s!\n", topkeypath));
 		result = WERR_REG_IO_FAILURE;
 	}
 	
-	regval_ctr_destroy( &values );
-	regsubkey_ctr_destroy( &subkeys );
+	TALLOC_FREE( subkeys );
 	
 	if ( !W_ERROR_IS_OK(result) )
 		return result;
@@ -904,8 +913,8 @@ static WERROR reg_write_tree( REGF_FILE *regfile, const char *keypath,
                               REGF_NK_REC *parent, SEC_DESC *sec_desc )
 {
 	REGF_NK_REC *key;
-	REGVAL_CTR values;
-	REGSUBKEY_CTR subkeys;
+	REGVAL_CTR *values;
+	REGSUBKEY_CTR *subkeys;
 	int i, num_subkeys;
 	pstring key_tmp;
 	char *keyname, *parentpath;
@@ -939,24 +948,27 @@ static WERROR reg_write_tree( REGF_FILE *regfile, const char *keypath,
 	
 	/* lookup the values and subkeys */
 	
-	regsubkey_ctr_init( &subkeys );
-	regval_ctr_init( &values );
-	
-	fetch_reg_keys( &registry_key, &subkeys );
-	fetch_reg_values( &registry_key, &values );
+	if ( !(subkeys = TALLOC_ZERO_P( regfile->mem_ctx, REGSUBKEY_CTR )) )
+		return WERR_NOMEM;
+
+	if ( !(values = TALLOC_ZERO_P( subkeys, REGVAL_CTR )) )
+		return WERR_NOMEM;
+
+	fetch_reg_keys( &registry_key, subkeys );
+	fetch_reg_values( &registry_key, values );
 
 	/* write out this key */
 		
-	if ( !(key = regfio_write_key( regfile, keyname, &values, &subkeys, sec_desc, parent )) ) {
+	if ( !(key = regfio_write_key( regfile, keyname, values, subkeys, sec_desc, parent )) ) {
 		result = WERR_CAN_NOT_COMPLETE;
 		goto done;
 	}
 
 	/* write each one of the subkeys out */
 
-	num_subkeys = regsubkey_ctr_numkeys( &subkeys );
+	num_subkeys = regsubkey_ctr_numkeys( subkeys );
 	for ( i=0; i<num_subkeys; i++ ) {
-		subkeyname = regsubkey_ctr_specific_key( &subkeys, i );
+		subkeyname = regsubkey_ctr_specific_key( subkeys, i );
 		pstr_sprintf( subkeypath, "%s\\%s", keypath, subkeyname );
 		result = reg_write_tree( regfile, subkeypath, key, sec_desc );
 		if ( !W_ERROR_IS_OK(result) )
@@ -966,8 +978,7 @@ static WERROR reg_write_tree( REGF_FILE *regfile, const char *keypath,
 	DEBUG(6,("reg_write_tree: wrote key [%s]\n", keypath ));
 
 done:
-	regval_ctr_destroy( &values );
-	regsubkey_ctr_destroy( &subkeys );
+	TALLOC_FREE( subkeys );
 
 	return result;
 }
@@ -1079,7 +1090,7 @@ WERROR _reg_create_key_ex(pipes_struct *p, REG_Q_CREATE_KEY_EX *q_u, REG_R_CREAT
 	REGISTRY_KEY *parent = find_regkey_index_by_hnd(p, &q_u->handle);
 	REGISTRY_KEY *newparent;
 	POLICY_HND newparent_handle;
-	REGSUBKEY_CTR subkeys;
+	REGSUBKEY_CTR *subkeys;
 	BOOL write_result;
 	pstring name;
 	WERROR result;
@@ -1138,19 +1149,22 @@ WERROR _reg_create_key_ex(pipes_struct *p, REG_Q_CREATE_KEY_EX *q_u, REG_R_CREAT
 		goto done;
 	}	
 		
-	regsubkey_ctr_init( &subkeys );
-	
+	if ( !(subkeys = TALLOC_ZERO_P( p->mem_ctx, REGSUBKEY_CTR )) ) {
+		result = WERR_NOMEM;
+		goto done;
+	}
+
 	/* (4) lookup the current keys and add the new one */
 	
-	fetch_reg_keys( newparent, &subkeys );
-	regsubkey_ctr_addkey( &subkeys, name );
+	fetch_reg_keys( newparent, subkeys );
+	regsubkey_ctr_addkey( subkeys, name );
 	
 	/* now write to the registry backend */
 	
-	write_result = store_reg_keys( newparent, &subkeys );
-	
-	regsubkey_ctr_destroy( &subkeys );
+	write_result = store_reg_keys( newparent, subkeys );
 	
+	TALLOC_FREE( subkeys );
+
 	if ( !write_result )
 		return WERR_REG_IO_FAILURE;
 		
@@ -1177,7 +1191,7 @@ done:
 WERROR _reg_set_value(pipes_struct *p, REG_Q_SET_VALUE  *q_u, REG_R_SET_VALUE *r_u)
 {
 	REGISTRY_KEY *key = find_regkey_index_by_hnd(p, &q_u->handle);
-	REGVAL_CTR values;
+	REGVAL_CTR *values;
 	BOOL write_result;
 	fstring valuename;
 
@@ -1198,19 +1212,20 @@ WERROR _reg_set_value(pipes_struct *p, REG_Q_SET_VALUE  *q_u, REG_R_SET_VALUE *r
 
 	DEBUG(8,("_reg_set_value: Setting value for [%s:%s]\n", key->name, valuename));
 		
-	regval_ctr_init( &values );
+	if ( !(values = TALLOC_ZERO_P( p->mem_ctx, REGVAL_CTR )) )
+		return WERR_NOMEM; 
 	
 	/* lookup the current values and add the new one */
 	
-	fetch_reg_values( key, &values );
+	fetch_reg_values( key, values );
 	
-	regval_ctr_addvalue( &values, valuename, q_u->type, q_u->value.buffer, q_u->value.buf_len );
+	regval_ctr_addvalue( values, valuename, q_u->type, q_u->value.buffer, q_u->value.buf_len );
 	
 	/* now write to the registry backend */
 	
-	write_result = store_reg_values( key, &values );
+	write_result = store_reg_values( key, values );
 	
-	regval_ctr_destroy( &values );
+	TALLOC_FREE( values );
 	
 	if ( !write_result )
 		return WERR_REG_IO_FAILURE;
@@ -1226,7 +1241,7 @@ WERROR _reg_delete_key(pipes_struct *p, REG_Q_DELETE_KEY  *q_u, REG_R_DELETE_KEY
 	REGISTRY_KEY *parent = find_regkey_index_by_hnd(p, &q_u->handle);
 	REGISTRY_KEY *newparent;
 	POLICY_HND newparent_handle;
-	REGSUBKEY_CTR subkeys;
+	REGSUBKEY_CTR *subkeys;
 	BOOL write_result;
 	pstring name;
 	WERROR result;
@@ -1285,19 +1300,22 @@ WERROR _reg_delete_key(pipes_struct *p, REG_Q_DELETE_KEY  *q_u, REG_R_DELETE_KEY
 		goto done;
 	}
 
-	regsubkey_ctr_init( &subkeys );
+	if ( !(subkeys = TALLOC_ZERO_P( p->mem_ctx, REGSUBKEY_CTR )) ) {
+		result = WERR_NOMEM;
+		goto done;
+	}
 	
 	/* lookup the current keys and delete the new one */
 	
-	fetch_reg_keys( newparent, &subkeys );
+	fetch_reg_keys( newparent, subkeys );
 	
-	regsubkey_ctr_delkey( &subkeys, name );
+	regsubkey_ctr_delkey( subkeys, name );
 	
 	/* now write to the registry backend */
 	
-	write_result = store_reg_keys( newparent, &subkeys );
+	write_result = store_reg_keys( newparent, subkeys );
 	
-	regsubkey_ctr_destroy( &subkeys );
+	TALLOC_FREE( subkeys );
 
 	result = write_result ? WERR_OK : WERR_REG_IO_FAILURE;
 	
@@ -1317,7 +1335,7 @@ done:
 WERROR _reg_delete_value(pipes_struct *p, REG_Q_DELETE_VALUE  *q_u, REG_R_DELETE_VALUE *r_u)
 {
 	REGISTRY_KEY *key = find_regkey_index_by_hnd(p, &q_u->handle);
-	REGVAL_CTR values;
+	REGVAL_CTR *values;
 	BOOL write_result;
 	fstring valuename;
 	
@@ -1336,19 +1354,20 @@ WERROR _reg_delete_value(pipes_struct *p, REG_Q_DELETE_VALUE  *q_u, REG_R_DELETE
 
 	DEBUG(8,("_reg_delete_value: Setting value for [%s:%s]\n", key->name, valuename));
 
-	regval_ctr_init( &values );
+	if ( !(values = TALLOC_ZERO_P( p->mem_ctx, REGVAL_CTR )) )
+		return WERR_NOMEM;
 	
 	/* lookup the current values and add the new one */
 	
-	fetch_reg_values( key, &values );
+	fetch_reg_values( key, values );
 	
-	regval_ctr_delvalue( &values, valuename );
+	regval_ctr_delvalue( values, valuename );
 	
 	/* now write to the registry backend */
 	
-	write_result = store_reg_values( key, &values );
+	write_result = store_reg_values( key, values );
 	
-	regval_ctr_destroy( &values );
+	TALLOC_FREE( values );
 	
 	if ( !write_result )
 		return WERR_REG_IO_FAILURE;
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index 5391ac5f41..ee35b5853f 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -274,62 +274,6 @@ static Printer_entry *find_printer_index_by_hnd(pipes_struct *p, POLICY_HND *hnd
 	return find_printer;
 }
 
-#ifdef ENABLE_PRINT_HND_OBJECT_CACHE
-/****************************************************************************
- look for a printer object cached on an open printer handle
-****************************************************************************/
-
-WERROR find_printer_in_print_hnd_cache( TALLOC_CTX *ctx, NT_PRINTER_INFO_LEVEL_2 **info2, 
-                                        const char *servername, const char *printername )
-{
-	Printer_entry *p;
-	
-	DEBUG(10,("find_printer_in_print_hnd_cache: printer [\\\\%s\\%s]\n", 
-		servername, printername));
-
-	for ( p=printers_list; p; p=p->next )
-	{
-		if ( p->printer_type==PRINTER_HANDLE_IS_PRINTER 
-			&& p->printer_info
-			&& strequal( p->sharename, printername )
-			&& strequal( p->servername, servername ) )
-		{
-			DEBUG(10,("Found printer\n"));
-			*info2 = dup_printer_2( ctx, p->printer_info->info_2 );
-			if ( *info2 )
-				return WERR_OK;
-		}
-	}
-
-	return WERR_INVALID_PRINTER_NAME;
-}
-
-/****************************************************************************
-  destroy any cached printer_info_2 structures on open handles
-****************************************************************************/
-
-void invalidate_printer_hnd_cache( char *printername )
-{
-	Printer_entry *p;
-	
-	DEBUG(10,("invalidate_printer_hnd_cache: printer [%s]\n", printername));
-
-	for ( p=printers_list; p; p=p->next )
-	{
-		if ( p->printer_type==PRINTER_HANDLE_IS_PRINTER 
-			&& p->printer_info
-			&& StrCaseCmp(p->sharename, printername)==0)
-		{
-			DEBUG(10,("invalidating printer_info cache for handl:\n"));
-			free_a_printer( &p->printer_info, 2 );
-			p->printer_info = NULL;
-		}
-	}
-
-	return;
-}
-#endif
-
 /****************************************************************************
  Close printer index by handle.
 ****************************************************************************/
@@ -1216,24 +1160,6 @@ static void receive_notify2_message_list(int msg_type, pid_t src, void *msg, siz
 	return;
 }
 
-#ifdef ENABLE_PRINT_HND_OBJECT_CACHE
-/********************************************************************
- callback to MSG_PRINTER_CHANGED.  When a printer is changed by 
- one smbd, all of processes must clear their printer cache immediately.
- ********************************************************************/
-
-void receive_printer_mod_msg(int msg_type, pid_t src, void *buf, size_t len)
-{
-	fstring printername;
-	
-	fstrcpy( printername, buf );
-	
-	DEBUG(10,("receive_printer_mod_msg: Printer change [%s]\n", printername ));
-	
-	invalidate_printer_hnd_cache( printername );
-}
-#endif
-
 /********************************************************************
  Send a message to ourself about new driver being installed
  so we can upgrade the information for each printer bound to this
@@ -1804,7 +1730,10 @@ static BOOL convert_printer_info(const SPOOL_PRINTER_INFO_LEVEL *uni,
 
 	switch (level) {
 		case 2:
-			ret = uni_2_asc_printer_info_2(uni->info_2, &printer->info_2);
+			/* printer->info_2  is already a valid printer */
+			ret = uni_2_asc_printer_info_2(uni->info_2, printer->info_2);
+			printer->info_2->setuptime = time(NULL);
+
 			break;
 		default:
 			break;
@@ -2272,8 +2201,8 @@ static WERROR delete_printer_dataex( NT_PRINTER_INFO_LEVEL *printer, const char
 WERROR set_printer_dataex( NT_PRINTER_INFO_LEVEL *printer, const char *key, const char *value, 
                                   uint32 type, uint8 *data, int real_len  )
 {
-	delete_printer_data( printer->info_2, key, value );
-	
+	/* the registry objects enforce uniqueness based on value name */
+
 	return add_printer_data( printer->info_2, key, value, type, data, real_len );
 }
 
@@ -4234,22 +4163,19 @@ static BOOL construct_printer_info_2(Printer_entry *print_hnd, PRINTER_INFO_2 *p
 	printer->cjobs = count;							/* jobs */
 	printer->averageppm = ntprinter->info_2->averageppm;			/* average pages per minute */
 			
-	if((printer->devmode = construct_dev_mode(snum)) == NULL) {
+	if ( !(printer->devmode = construct_dev_mode(snum)) )
 		DEBUG(8, ("Returning NULL Devicemode!\n"));
-	}
 
-	if (ntprinter->info_2->secdesc_buf && ntprinter->info_2->secdesc_buf->len != 0) {
-		/* steal the printer info sec_desc structure.  [badly done]. */
-		printer->secdesc = ntprinter->info_2->secdesc_buf->sec;
-		ntprinter->info_2->secdesc_buf->sec = NULL; /* Stolen memory. */
-		ntprinter->info_2->secdesc_buf->len = 0; /* Stolen memory. */
-		ntprinter->info_2->secdesc_buf->max_len = 0; /* Stolen memory. */
-	}
-	else {
-		printer->secdesc = NULL;
+	printer->secdesc = NULL;
+
+	if ( ntprinter->info_2->secdesc_buf 
+		&& ntprinter->info_2->secdesc_buf->len != 0 ) 
+	{
+		printer->secdesc = dup_sec_desc( get_talloc_ctx(), ntprinter->info_2->secdesc_buf->sec );
 	}
 
 	free_a_printer(&ntprinter, 2);
+
 	return True;
 }
 
@@ -4274,32 +4200,12 @@ static BOOL construct_printer_info_3(Printer_entry *print_hnd, PRINTER_INFO_3 **
 
 	ZERO_STRUCTP(printer);
 	
-	printer->flags = 4; /* These are the components of the SD we are returning. */
-	if (ntprinter->info_2->secdesc_buf && ntprinter->info_2->secdesc_buf->len != 0) {
-		/* steal the printer info sec_desc structure.  [badly done]. */
-		printer->secdesc = ntprinter->info_2->secdesc_buf->sec;
-
-#if 0
-		/*
-		 * Set the flags for the components we are returning.
-		 */
+	/* These are the components of the SD we are returning. */
 
-		if (printer->secdesc->owner_sid)
-			printer->flags |= OWNER_SECURITY_INFORMATION;
+	printer->flags = 0x4; 
 
-		if (printer->secdesc->grp_sid)
-			printer->flags |= GROUP_SECURITY_INFORMATION;
-
-		if (printer->secdesc->dacl)
-			printer->flags |= DACL_SECURITY_INFORMATION;
-
-		if (printer->secdesc->sacl)
-			printer->flags |= SACL_SECURITY_INFORMATION;
-#endif
-
-		ntprinter->info_2->secdesc_buf->sec = NULL; /* Stolen the malloced memory. */
-		ntprinter->info_2->secdesc_buf->len = 0; /* Stolen the malloced memory. */
-		ntprinter->info_2->secdesc_buf->max_len = 0; /* Stolen the malloced memory. */
+	if (ntprinter->info_2->secdesc_buf && ntprinter->info_2->secdesc_buf->len != 0) {
+		printer->secdesc = dup_sec_desc( get_talloc_ctx(), ntprinter->info_2->secdesc_buf->sec );
 	}
 
 	free_a_printer(&ntprinter, 2);
@@ -4582,16 +4488,20 @@ static WERROR enum_all_printers_info_2(RPC_BUFFER *buffer, uint32 offered, uint3
 		if (lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) ) {
 			DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
 				
-			if (construct_printer_info_2(NULL, &current_prt, snum)) {
-				if((tp=SMB_REALLOC_ARRAY(printers, PRINTER_INFO_2, *returned +1)) == NULL) {
+			if (construct_printer_info_2(NULL, &current_prt, snum)) 
+			{
+				if ( !(tp=SMB_REALLOC_ARRAY(printers, PRINTER_INFO_2, *returned +1)) ) {
 					DEBUG(2,("enum_all_printers_info_2: failed to enlarge printers buffer!\n"));
 					SAFE_FREE(printers);
 					*returned = 0;
 					return WERR_NOMEM;
 				}
-				else printers = tp;
+
 				DEBUG(4,("ReAlloced memory for [%d] PRINTER_INFO_2\n", *returned));		
+
+				printers = tp;
 				memcpy(&printers[*returned], &current_prt, sizeof(PRINTER_INFO_2));
+
 				(*returned)++;
 			}
 		}
@@ -4617,9 +4527,10 @@ static WERROR enum_all_printers_info_2(RPC_BUFFER *buffer, uint32 offered, uint3
 	
 out:
 	/* clear memory */
-	for (i=0; i<*returned; i++) {
+
+	for (i=0; i<*returned; i++) 
 		free_devmode(printers[i].devmode);
-	}
+
 	SAFE_FREE(printers);
 
 	if ( !W_ERROR_IS_OK(result) )
@@ -7905,8 +7816,6 @@ WERROR _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, S
 	int		i, key_index, num_values;
 	int		name_length;
 	
-	ZERO_STRUCT( printer );
-	
 	*out_type = 0;
 
 	*out_max_data_len = 0;
@@ -7927,7 +7836,7 @@ WERROR _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, S
 	if (!W_ERROR_IS_OK(result))
 		return result;
 		
-	p_data = &printer->info_2->data;	
+	p_data = printer->info_2->data;	
 	key_index = lookup_printerkey( p_data, SPOOL_PRINTERDATA_KEY );
 
 	result = WERR_OK;
@@ -7945,11 +7854,11 @@ WERROR _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, S
 		biggest_valuesize = 0;
 		biggest_datasize  = 0;
 				
-		num_values = regval_ctr_numvals( &p_data->keys[key_index].values );
-		
+		num_values = regval_ctr_numvals( p_data->keys[key_index].values );
+	
 		for ( i=0; i<num_values; i++ )
 		{
-			val = regval_ctr_specific_value( &p_data->keys[key_index].values, i );
+			val = regval_ctr_specific_value( p_data->keys[key_index].values, i );
 			
 			name_length = strlen(val->valuename);
 			if ( strlen(val->valuename) > biggest_valuesize ) 
@@ -7979,7 +7888,7 @@ WERROR _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, S
 	 */
 	
 	if ( key_index != -1 )
-		val = regval_ctr_specific_value( &p_data->keys[key_index].values, idx );
+		val = regval_ctr_specific_value( p_data->keys[key_index].values, idx );
 
 	if ( !val ) 
 	{
@@ -8937,7 +8846,7 @@ WERROR _spoolss_getprinterdataex(pipes_struct *p, SPOOL_Q_GETPRINTERDATAEX *q_u,
 		goto done;
 	}
 	
-	if ( lookup_printerkey( &printer->info_2->data, keyname ) == -1 ) {
+	if ( lookup_printerkey( printer->info_2->data, keyname ) == -1 ) {
 		DEBUG(4,("_spoolss_getprinterdataex: Invalid keyname [%s]\n", keyname ));
 		free_a_printer( &printer, 2 );
 		status = WERR_BADFILE;
@@ -9158,7 +9067,7 @@ WERROR _spoolss_enumprinterkey(pipes_struct *p, SPOOL_Q_ENUMPRINTERKEY *q_u, SPO
 	/* get the list of subkey names */
 	
 	unistr2_to_ascii( key, &q_u->key, sizeof(key)-1 );
-	data = &printer->info_2->data;
+	data = printer->info_2->data;
 
 	num_keys = get_printer_subkeys( data, key, &keynames );
 
@@ -9301,7 +9210,7 @@ WERROR _spoolss_enumprinterdataex(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATAEX *q_
 	
 	/* now look for a match on the key name */
 	
-	p_data = &printer->info_2->data;
+	p_data = printer->info_2->data;
 	
 	unistr2_to_ascii(key, &q_u->key, sizeof(key) - 1);
 	if ( (key_index = lookup_printerkey( p_data, key)) == -1  )
@@ -9316,7 +9225,7 @@ WERROR _spoolss_enumprinterdataex(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATAEX *q_
 	
 	/* allocate the memory for the array of pointers -- if necessary */
 	
-	num_entries = regval_ctr_numvals( &p_data->keys[key_index].values );
+	num_entries = regval_ctr_numvals( p_data->keys[key_index].values );
 	if ( num_entries )
 	{
 		if ( (enum_values=TALLOC_ARRAY(p->mem_ctx, PRINTER_ENUM_VALUES, num_entries)) == NULL )
@@ -9339,7 +9248,7 @@ WERROR _spoolss_enumprinterdataex(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATAEX *q_
 	{
 		/* lookup the registry value */
 		
-		val = regval_ctr_specific_value( &p_data->keys[key_index].values, i );
+		val = regval_ctr_specific_value( p_data->keys[key_index].values, i );
 		DEBUG(10,("retrieved value number [%d] [%s]\n", i, regval_name(val) ));
 
 		/* copy the data */