3 files changed, 31 insertions, 11 deletions
diff --git a/source4/librpc/idl/winreg.idl b/source4/librpc/idl/winreg.idl
index cbe60a96ba..04521304e7 100644
--- a/source4/librpc/idl/winreg.idl
+++ b/source4/librpc/idl/winreg.idl
@@ -211,14 +211,14 @@
 		[in,ref] policy_handle *handle,
 		[in] winreg_String class_in,
 		[out] winreg_String *class_out,
-		[out] uint32 *num_subkeys,
-		[out] uint32 *max_subkeylen,
-		[out] uint32 *max_subkeysize,
-		[out] uint32 *num_values,
-		[out] uint32 *max_valnamelen,
-		[out] uint32 *max_valbufsize,
-		[out] uint32 *secdescsize,
-		[out] NTTIME *last_changed_time
+		[out,ref] uint32 *num_subkeys,
+		[out,ref] uint32 *max_subkeylen,
+		[out,ref] uint32 *max_subkeysize,
+		[out,ref] uint32 *num_values,
+		[out,ref] uint32 *max_valnamelen,
+		[out,ref] uint32 *max_valbufsize,
+		[out,ref] uint32 *secdescsize,
+		[out,ref] NTTIME *last_changed_time
 	);
 
 	/******************/
@@ -289,8 +289,8 @@
 	/******************/
 	/* Function: 0x1a */
 	WERROR winreg_GetVersion(
-		[in,ref] policy_handle *handle,
-		[out]    uint32 *version
+		[in,ref]     policy_handle *handle,
+		[out,ref]    uint32 *version
 	);
 
 	/******************/
diff --git a/source4/rpc_server/winreg/rpc_winreg.c b/source4/rpc_server/winreg/rpc_winreg.c
index 86a78a5e9e..adcbb749da 100644
--- a/source4/rpc_server/winreg/rpc_winreg.c
+++ b/source4/rpc_server/winreg/rpc_winreg.c
@@ -523,7 +523,11 @@ static WERROR winreg_GetVersion(struct dcesrv_call_state *dce_call, TALLOC_CTX *
 
 	DCESRV_PULL_HANDLE_FAULT(h, r->in.handle, HTYPE_REGKEY);
 
+	r->out.version = talloc(mem_ctx, uint32_t);
+	NT_STATUS_HAVE_NO_MEMORY(r->out.version);
+
 	*r->out.version = 5;
+
 	return WERR_OK;
 }
 
diff --git a/source4/torture/rpc/winreg.c b/source4/torture/rpc/winreg.c
index 025411f3bd..370a023dd5 100644
--- a/source4/torture/rpc/winreg.c
+++ b/source4/torture/rpc/winreg.c
@@ -54,10 +54,12 @@ static BOOL test_GetVersion(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 {
 	NTSTATUS status;
 	struct winreg_GetVersion r;
-
+	uint32_t v;
 	printf("\ntesting GetVersion\n");
 
+	ZERO_STRUCT(r);
 	r.in.handle = handle;
+	r.out.version = &v;
 
 	status = dcerpc_winreg_GetVersion(p, mem_ctx, &r);
 
@@ -372,10 +374,24 @@ static BOOL test_QueryInfoKey(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 {
 	NTSTATUS status;
 	struct winreg_QueryInfoKey r;
+	uint32_t num_subkeys, max_subkeylen, max_subkeysize,
+		num_values, max_valnamelen, max_valbufsize,
+		secdescsize;
+	NTTIME last_changed_time;
 
 	printf("\ntesting QueryInfoKey\n");
 
+	ZERO_STRUCT(r);
 	r.in.handle = handle;
+	r.out.num_subkeys = &num_subkeys;
+	r.out.max_subkeylen = &max_subkeylen;
+	r.out.max_subkeysize = &max_subkeysize;
+	r.out.num_values = &num_values;
+	r.out.max_valnamelen = &max_valnamelen;
+	r.out.max_valbufsize = &max_valbufsize;
+	r.out.secdescsize = &secdescsize;
+	r.out.last_changed_time = &last_changed_time;
+	
 	init_winreg_String(&r.in.class_in, class);
 	
 	status = dcerpc_winreg_QueryInfoKey(p, mem_ctx, &r);