From 29a4d666bad176483a5a346d24dc1b044bf67b2b Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Tue, 25 Jul 2006 21:33:13 +0000 Subject: r17245: Second part of fix for #3962. Don't do a double free in the infolevel2 case. Free both queue and NT_PRINTER_INFO_LEVEL in the same place. Jeremy. (This used to be commit 6ac3a4ce78f42949013ae7bd675ff292fb0383ca) --- source3/rpc_server/srv_spoolss_nt.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) (limited to 'source3/rpc_server') diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c index db098e74be..cd0a4f2bb3 100644 --- a/source3/rpc_server/srv_spoolss_nt.c +++ b/source3/rpc_server/srv_spoolss_nt.c @@ -6395,9 +6395,9 @@ WERROR _spoolss_addjob(pipes_struct *p, SPOOL_Q_ADDJOB *q_u, SPOOL_R_ADDJOB *r_u /**************************************************************************** ****************************************************************************/ -static void fill_job_info_1(JOB_INFO_1 *job_info, print_queue_struct *queue, +static void fill_job_info_1(JOB_INFO_1 *job_info, const print_queue_struct *queue, int position, int snum, - NT_PRINTER_INFO_LEVEL *ntprinter) + const NT_PRINTER_INFO_LEVEL *ntprinter) { struct tm *t; @@ -6422,9 +6422,9 @@ static void fill_job_info_1(JOB_INFO_1 *job_info, print_queue_struct *queue, /**************************************************************************** ****************************************************************************/ -static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue, +static BOOL fill_job_info_2(JOB_INFO_2 *job_info, const print_queue_struct *queue, int position, int snum, - NT_PRINTER_INFO_LEVEL *ntprinter, + const NT_PRINTER_INFO_LEVEL *ntprinter, DEVICEMODE *devmode) { struct tm *t; @@ -6467,8 +6467,8 @@ static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue, Enumjobs at level 1. ****************************************************************************/ -static WERROR enumjobs_level1(print_queue_struct *queue, int snum, - NT_PRINTER_INFO_LEVEL *ntprinter, +static WERROR enumjobs_level1(const print_queue_struct *queue, int snum, + const NT_PRINTER_INFO_LEVEL *ntprinter, RPC_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned) { @@ -6478,7 +6478,6 @@ static WERROR enumjobs_level1(print_queue_struct *queue, int snum, info=SMB_MALLOC_ARRAY(JOB_INFO_1,*returned); if (info==NULL) { - SAFE_FREE(queue); *returned=0; return WERR_NOMEM; } @@ -6486,8 +6485,6 @@ static WERROR enumjobs_level1(print_queue_struct *queue, int snum, for (i=0; i<*returned; i++) fill_job_info_1( &info[i], &queue[i], i, snum, ntprinter ); - SAFE_FREE(queue); - /* check the required size. */ for (i=0; i<*returned; i++) (*needed) += spoolss_size_job_info_1(&info[i]); @@ -6520,8 +6517,8 @@ out: Enumjobs at level 2. ****************************************************************************/ -static WERROR enumjobs_level2(print_queue_struct *queue, int snum, - NT_PRINTER_INFO_LEVEL *ntprinter, +static WERROR enumjobs_level2(const print_queue_struct *queue, int snum, + const NT_PRINTER_INFO_LEVEL *ntprinter, RPC_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned) { @@ -6542,9 +6539,6 @@ static WERROR enumjobs_level2(print_queue_struct *queue, int snum, for (i=0; i<*returned; i++) fill_job_info_2(&(info[i]), &queue[i], i, snum, ntprinter, devmode); - free_a_printer(&ntprinter, 2); - SAFE_FREE(queue); - /* check the required size. */ for (i=0; i<*returned; i++) (*needed) += spoolss_size_job_info_2(&info[i]); -- cgit