From 8ff6458a3e568e759969fd1a9c827c4b47008cfb Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 1 Jun 2000 21:52:49 +0000 Subject: More insure found memory leak and corruption fixes. Jeremy. (This used to be commit 3cdcfa6325b9cd2d7f7c90c4b2d1c6ec73fc2f6d) --- source3/include/proto.h | 7 +++-- source3/printing/nt_printing.c | 21 +++++++++++++-- source3/rpc_parse/parse_misc.c | 9 +++++++ source3/rpc_parse/parse_spoolss.c | 54 ++++++++++++++++++++++++++++++++++--- source3/rpc_server/srv_spoolss.c | 3 +++ source3/rpc_server/srv_spoolss_nt.c | 6 ++--- 6 files changed, 89 insertions(+), 11 deletions(-) (limited to 'source3') diff --git a/source3/include/proto.h b/source3/include/proto.h index e1b444545b..050de09c65 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -1275,8 +1275,6 @@ char *lp_domain_admin_group(void); char *lp_domain_guest_group(void); char *lp_domain_admin_users(void); char *lp_domain_guest_users(void); -char *lp_nt_forms(void); -char *lp_nt_drivers_file(void); char *lp_winbind_uid(void); char *lp_winbind_gid(void); char *lp_template_homedir(void); @@ -1943,6 +1941,7 @@ void init_buffer3_hex(BUFFER3 *str, char *buf); void init_buffer3_bytes(BUFFER3 *str, uint8 *buf, int len); BOOL smb_io_buffer3(char *desc, BUFFER3 *buf3, prs_struct *ps, int depth); BOOL smb_io_buffer5(char *desc, BUFFER5 *buf5, prs_struct *ps, int depth); +void free_buffer5(BUFFER5 *buf5); void init_buffer2(BUFFER2 *str, uint8 *buf, int len); BOOL smb_io_buffer2(char *desc, BUFFER2 *buf2, uint32 buffer, prs_struct *ps, int depth); void init_buf_unistr2(UNISTR2 *str, uint32 *ptr, const char *buf); @@ -2559,11 +2558,15 @@ BOOL spoolss_io_q_addprinterex(char *desc, SPOOL_Q_ADDPRINTEREX *q_u, prs_struct BOOL spoolss_io_r_addprinterex(char *desc, SPOOL_R_ADDPRINTEREX *r_u, prs_struct *ps, int depth); BOOL spool_io_printer_driver_info_level_3(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u, prs_struct *ps, int depth); +void free_spool_printer_driver_info_level_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u); BOOL spool_io_printer_driver_info_level_6(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u, prs_struct *ps, int depth); +void free_spool_printer_driver_info_level_6(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u); BOOL smb_io_unibuffer(char *desc, UNISTR2 *buffer, prs_struct *ps, int depth); BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL *il, prs_struct *ps, int depth); +void free_spool_printer_driver_info_level(SPOOL_PRINTER_DRIVER_INFO_LEVEL *il); BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth); +void free_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u); BOOL spoolss_io_r_addprinterdriver(char *desc, SPOOL_R_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth); BOOL uni_2_asc_printer_driver_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *uni, NT_PRINTER_DRIVER_INFO_LEVEL_3 **asc); diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c index de3b9ed6c5..82facbe453 100644 --- a/source3/printing/nt_printing.c +++ b/source3/printing/nt_printing.c @@ -1276,18 +1276,35 @@ uint32 get_a_printer_driver(NT_PRINTER_DRIVER_INFO_LEVEL *driver, uint32 level, uint32 free_a_printer_driver(NT_PRINTER_DRIVER_INFO_LEVEL driver, uint32 level) { uint32 success; - NT_PRINTER_DRIVER_INFO_LEVEL_3 *info3; switch (level) { case 3: { + NT_PRINTER_DRIVER_INFO_LEVEL_3 *info3; if (driver.info_3 != NULL) { info3=driver.info_3; safe_free(info3->dependentfiles); - safe_free(info3); ZERO_STRUCTP(info3); + safe_free(info3); + success=0; + } + else + { + success=4; + } + break; + } + case 6: + { + NT_PRINTER_DRIVER_INFO_LEVEL_3 *info6; + if (driver.info_6 != NULL) + { + info6=driver.info_6; + safe_free(info6->dependentfiles); + ZERO_STRUCTP(info6); + safe_free(info6); success=0; } else diff --git a/source3/rpc_parse/parse_misc.c b/source3/rpc_parse/parse_misc.c index da2aa4450e..fe2778a356 100644 --- a/source3/rpc_parse/parse_misc.c +++ b/source3/rpc_parse/parse_misc.c @@ -617,6 +617,15 @@ BOOL smb_io_buffer5(char *desc, BUFFER5 *buf5, prs_struct *ps, int depth) return True; } +/******************************************************************* + Frees a BUFFER5 structure (just the malloced part). +********************************************************************/ + +void free_buffer5(BUFFER5 *buf5) +{ + safe_free(buf5->buffer); +} + /******************************************************************* Inits a BUFFER2 structure. ********************************************************************/ diff --git a/source3/rpc_parse/parse_spoolss.c b/source3/rpc_parse/parse_spoolss.c index 2565439a21..5ed7ce2460 100644 --- a/source3/rpc_parse/parse_spoolss.c +++ b/source3/rpc_parse/parse_spoolss.c @@ -3691,11 +3691,22 @@ BOOL spool_io_printer_driver_info_level_3(char *desc, SPOOL_PRINTER_DRIVER_INFO_ return False; if (il->dependentfiles_ptr) - smb_io_buffer5("", &(il->dependentfiles), ps, depth); + smb_io_buffer5("", &il->dependentfiles, ps, depth); return True; } +void free_spool_printer_driver_info_level_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u) +{ + SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *il = *q_u; + + if (il == NULL) + return; + + free_buffer5(&il->dependentfiles); + + safe_free(q_u); +} /******************************************************************* parse a SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 structure @@ -3836,6 +3847,19 @@ BOOL spool_io_printer_driver_info_level_6(char *desc, SPOOL_PRINTER_DRIVER_INFO_ return True; } +void free_spool_printer_driver_info_level_6(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u) +{ + SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 *il = *q_u; + + if (il == NULL) + return; + + free_buffer5(&il->dependentfiles); + free_buffer5(&il->previousnames); + + safe_free(q_u); +} + /******************************************************************* convert a buffer of UNICODE strings null terminated @@ -3908,11 +3932,11 @@ BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LE switch (il->level) { case 3: - if(!spool_io_printer_driver_info_level_3("", &(il->info_3), ps, depth)) + if(!spool_io_printer_driver_info_level_3("", &il->info_3, ps, depth)) return False; break; case 6: - if(!spool_io_printer_driver_info_level_6("", &(il->info_6), ps, depth)) + if(!spool_io_printer_driver_info_level_6("", &il->info_6, ps, depth)) return False; break; default: @@ -3922,6 +3946,21 @@ BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LE return True; } +void free_spool_printer_driver_info_level(SPOOL_PRINTER_DRIVER_INFO_LEVEL *il) +{ + if (il->ptr==0) + return; + + switch (il->level) { + case 3: + free_spool_printer_driver_info_level_3(&il->info_3); + break; + case 6: + free_spool_printer_driver_info_level_6(&il->info_6); + break; + } +} + /******************************************************************* ********************************************************************/ BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth) @@ -3948,6 +3987,15 @@ BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, pr return True; } +/******************************************************************* + Free the dynamic parts of a printer driver. +********************************************************************/ + +void free_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u) +{ + free_spool_printer_driver_info_level(&q_u->info); +} + /******************************************************************* ********************************************************************/ BOOL spoolss_io_r_addprinterdriver(char *desc, SPOOL_R_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth) diff --git a/source3/rpc_server/srv_spoolss.c b/source3/rpc_server/srv_spoolss.c index 74901efa78..2513fe91e6 100755 --- a/source3/rpc_server/srv_spoolss.c +++ b/source3/rpc_server/srv_spoolss.c @@ -833,9 +833,12 @@ static BOOL api_spoolss_addprinterdriver(prs_struct *data, prs_struct *rdata) if(!spoolss_io_r_addprinterdriver("", &r_u, rdata, 0)) { DEBUG(0,("spoolss_io_r_addprinterdriver: unable to marshall SPOOL_R_ADDPRINTERDRIVER.\n")); + free_spoolss_q_addprinterdriver(&q_u); return False; } + free_spoolss_q_addprinterdriver(&q_u); + return True; } diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c index f181585c84..b77deca158 100644 --- a/source3/rpc_server/srv_spoolss_nt.c +++ b/source3/rpc_server/srv_spoolss_nt.c @@ -3917,14 +3917,12 @@ uint32 _spoolss_addprinterdriver( const UNISTR2 *server_name, #ifdef RELIES_ON_SMBD_FUNCTIONS_LINKED_INTO_SPOOLSSD if ((err = modify_driver_heirarchy(&driver, level)) != 0) { - safe_free(driver.info_3); - safe_free(driver.info_6); + free_a_printer_driver(driver, level); return err; } #endif - safe_free(driver.info_3); - safe_free(driver.info_6); + free_a_printer_driver(driver, level); return NT_STATUS_NO_PROBLEMO; } -- cgit