Move to talloc control of SPOOL_XXX structs. Move to talloc control of

security descriptors and pointers. Syncup with 2.2 tree.
Jeremy.

source/include/proto.h

@@ -369,6 +369,7 @@ void talloc_destroy_pool(TALLOC_CTX *t);
 void talloc_destroy(TALLOC_CTX *t);
 size_t talloc_pool_size(TALLOC_CTX *t);
 void *talloc_zero(TALLOC_CTX *t, size_t size);
+void *talloc_memdup(TALLOC_CTX *t, void *p, size_t size);
 
 /*The following definitions come from  lib/time.c  */
 
@@ -522,7 +523,7 @@ struct cli_connection* RpcHndList_get_connection(const POLICY_HND *hnd);
 void se_map_generic(uint32 *access_mask, struct generic_mapping *mapping);
 BOOL se_access_check(SEC_DESC *sd, struct current_user *user,
 		     uint32 acc_desired, uint32 *acc_granted, uint32 *status);
-SEC_DESC_BUF *se_create_child_secdesc(SEC_DESC *parent_ctr, 
+SEC_DESC_BUF *se_create_child_secdesc(TALLOC_CTX *ctx, SEC_DESC *parent_ctr, 
 				      BOOL child_container);
 
 /*The following definitions come from  lib/util_sec.c  */
@@ -1993,7 +1994,7 @@ BOOL get_specific_param_by_index(NT_PRINTER_INFO_LEVEL printer, uint32 level, ui
 BOOL get_specific_param(NT_PRINTER_INFO_LEVEL printer, uint32 level,
                         fstring value, uint8 **data, uint32 *type, uint32 *len);
 uint32 nt_printing_setsec(char *printername, SEC_DESC_BUF *secdesc_ctr);
-BOOL nt_printing_getsec(char *printername, SEC_DESC_BUF **secdesc_ctr);
+BOOL nt_printing_getsec(TALLOC_CTX *ctx, char *printername, SEC_DESC_BUF **secdesc_ctr);
 void map_printer_permissions(SEC_DESC *sd);
 BOOL print_access_check(struct current_user *user, int snum, int access_type);
 BOOL print_time_access_check(int snum);
@@ -2969,26 +2970,23 @@ void init_sec_access(SEC_ACCESS *t, uint32 mask);
 BOOL sec_io_access(char *desc, SEC_ACCESS *t, prs_struct *ps, int depth);
 void init_sec_ace(SEC_ACE *t, DOM_SID *sid, uint8 type, SEC_ACCESS mask, uint8 flag);
 BOOL sec_io_ace(char *desc, SEC_ACE *psa, prs_struct *ps, int depth);
-SEC_ACL *make_sec_acl(uint16 revision, int num_aces, SEC_ACE *ace_list);
+SEC_ACL *make_sec_acl(TALLOC_CTX *ctx, uint16 revision, int num_aces, SEC_ACE *ace_list);
-SEC_ACL *dup_sec_acl( SEC_ACL *src);
+SEC_ACL *dup_sec_acl(TALLOC_CTX *ctx, SEC_ACL *src);
-void free_sec_acl(SEC_ACL **ppsa);
 BOOL sec_io_acl(char *desc, SEC_ACL **ppsa, prs_struct *ps, int depth);
 size_t sec_desc_size(SEC_DESC *psd);
 BOOL sec_ace_equal(SEC_ACE *s1, SEC_ACE *s2);
 BOOL sec_acl_equal(SEC_ACL *s1, SEC_ACL *s2);
 BOOL sec_desc_equal(SEC_DESC *s1, SEC_DESC *s2);
-SEC_DESC_BUF *sec_desc_merge(SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb);
+SEC_DESC_BUF *sec_desc_merge(TALLOC_CTX *ctx, SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb);
-SEC_DESC *make_sec_desc(uint16 revision, 
+SEC_DESC *make_sec_desc(TALLOC_CTX *ctx, uint16 revision, 
 			DOM_SID *owner_sid, DOM_SID *grp_sid,
 			SEC_ACL *sacl, SEC_ACL *dacl, size_t *sd_size);
-SEC_DESC *dup_sec_desc( SEC_DESC *src);
+SEC_DESC *dup_sec_desc( TALLOC_CTX *ctx, SEC_DESC *src);
-void free_sec_desc(SEC_DESC **ppsd);
+SEC_DESC *make_standard_sec_desc(TALLOC_CTX *ctx, DOM_SID *owner_sid, DOM_SID *grp_sid,
-SEC_DESC *make_standard_sec_desc(DOM_SID *owner_sid, DOM_SID *grp_sid,
 				 SEC_ACL *dacl, size_t *sd_size);
 BOOL sec_io_desc(char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth);
-SEC_DESC_BUF *make_sec_desc_buf(size_t len, SEC_DESC *sec_desc);
+SEC_DESC_BUF *make_sec_desc_buf(TALLOC_CTX *ctx, size_t len, SEC_DESC *sec_desc);
-SEC_DESC_BUF *dup_sec_desc_buf(SEC_DESC_BUF *src);
+SEC_DESC_BUF *dup_sec_desc_buf(TALLOC_CTX *ctx, SEC_DESC_BUF *src);
-void free_sec_desc_buf(SEC_DESC_BUF **ppsdb);
 BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int depth);
 
 /*The following definitions come from  rpc_parse/parse_spoolss.c  */
@@ -2996,21 +2994,18 @@ BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int depth
 BOOL make_systemtime(SYSTEMTIME *systime, struct tm *unixtime);
 BOOL smb_io_notify_info_data_strings(char *desc,SPOOL_NOTIFY_INFO_DATA *data,
                                      prs_struct *ps, int depth);
-void free_spoolss_devmode(DEVICEMODE *devmode);
 BOOL make_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u,
 		const fstring printername, 
 		const fstring datatype, 
 		uint32 access_required,
 		const fstring clientname,
 		const fstring user_name);
-BOOL make_spoolss_q_addprinterex(SPOOL_Q_ADDPRINTEREX *q_u, const char *srv_name,
+BOOL make_spoolss_q_addprinterex(TALLOC_CTX *ctx, SPOOL_Q_ADDPRINTEREX *q_u, const char *srv_name,
 				 const char* clientname, const char* user_name,
 				 uint32 level, PRINTER_INFO_2 *info);
-void free_spoolss_q_addprinterex(SPOOL_Q_ADDPRINTEREX *q_u);
+BOOL make_spool_printer_info_2(TALLOC_CTX *ctx, SPOOL_PRINTER_INFO_LEVEL_2 **spool_info2, 
-BOOL make_spool_printer_info_2(SPOOL_PRINTER_INFO_LEVEL_2 **spool_info2, 
 			       PRINTER_INFO_2 *info);
 BOOL spoolss_io_q_open_printer_ex(char *desc, SPOOL_Q_OPEN_PRINTER_EX *q_u, prs_struct *ps, int depth);
-void free_spoolss_q_open_printer_ex(SPOOL_Q_OPEN_PRINTER_EX *q_u);
 BOOL spoolss_io_r_open_printer_ex(char *desc, SPOOL_R_OPEN_PRINTER_EX *r_u, prs_struct *ps, int depth);
 BOOL make_spoolss_q_getprinterdata(SPOOL_Q_GETPRINTERDATA *q_u,
                                 const POLICY_HND *handle,
@@ -3054,8 +3049,6 @@ BOOL new_smb_io_job_info_1(char *desc, NEW_BUFFER *buffer, JOB_INFO_1 *info, int
 BOOL new_smb_io_job_info_2(char *desc, NEW_BUFFER *buffer, JOB_INFO_2 *info, int depth);
 BOOL new_smb_io_form_1(char *desc, NEW_BUFFER *buffer, FORM_1 *info, int depth);
 void new_spoolss_move_buffer(NEW_BUFFER *src, NEW_BUFFER **dest);
-BOOL new_spoolss_allocate_buffer(NEW_BUFFER **buffer);
-void new_spoolss_free_buffer(NEW_BUFFER *buffer);
 uint32 new_get_buffer_size(NEW_BUFFER *buffer);
 BOOL new_smb_io_driverdir_1(char *desc, NEW_BUFFER *buffer, DRIVER_DIRECTORY_1 *info, int depth);
 BOOL new_smb_io_port_1(char *desc, NEW_BUFFER *buffer, PORT_INFO_1 *info, int depth);
@@ -3103,7 +3096,6 @@ BOOL spoolss_io_q_getprinter(char *desc, SPOOL_Q_GETPRINTER *q_u, prs_struct *ps
 BOOL make_spoolss_q_getprinter(SPOOL_Q_GETPRINTER *q_u, const POLICY_HND *hnd, uint32 level, 
 				NEW_BUFFER *buffer, uint32 offered);
 BOOL spoolss_io_r_setprinter(char *desc, SPOOL_R_SETPRINTER *r_u, prs_struct *ps, int depth);
-void free_spoolss_q_setprinter(SPOOL_Q_SETPRINTER *q_u);
 BOOL spoolss_io_q_setprinter(char *desc, SPOOL_Q_SETPRINTER *q_u, prs_struct *ps, int depth);
 BOOL spoolss_io_r_fcpn(char *desc, SPOOL_R_FCPN *r_u, prs_struct *ps, int depth);
 BOOL spoolss_io_q_fcpn(char *desc, SPOOL_Q_FCPN *q_u, prs_struct *ps, int depth);
@@ -3143,23 +3135,17 @@ BOOL spoolss_io_r_addprinterex(char *desc, SPOOL_R_ADDPRINTEREX *r_u,
 			       prs_struct *ps, int depth);
 BOOL spool_io_printer_driver_info_level_3(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u, 
                                           prs_struct *ps, int depth);
-void free_spool_printer_driver_info_level_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u);
 BOOL spool_io_printer_driver_info_level_6(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u, 
                                           prs_struct *ps, int depth);
-void free_spool_printer_driver_info_level_6(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u);
 BOOL smb_io_unibuffer(char *desc, UNISTR2 *buffer, prs_struct *ps, int depth);
 BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL *il, prs_struct *ps, int depth);
-void free_spool_printer_driver_info_level(SPOOL_PRINTER_DRIVER_INFO_LEVEL *il);
+BOOL make_spoolss_q_addprinterdriver(TALLOC_CTX *ctx, SPOOL_Q_ADDPRINTERDRIVER *q_u, 
-BOOL make_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u, 
 				     const char* srv_name, uint32 level, 
 				     PRINTER_DRIVER_CTR *info);
-BOOL make_spool_driver_info_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *spool_drv_info,
+BOOL make_spool_driver_info_3(TALLOC_CTX *ctx, SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *spool_drv_info,
 			      DRIVER_INFO_3 *info3);
-void free_spool_driver_info_3 (SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *info);
+BOOL make_spool_buffer5(TALLOC_CTX *ctx, BUFFER5 *buf5, uint32 len, uint16 *src);
-BOOL make_spool_buffer5(BUFFER5 *buf5, uint32 len, uint16 *src);
-void free_spool_buffer5(BUFFER5 *buf);
 BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth);
-void free_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u);
 BOOL spoolss_io_r_addprinterdriver(char *desc, SPOOL_R_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth);
 BOOL uni_2_asc_printer_driver_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *uni,
                                 NT_PRINTER_DRIVER_INFO_LEVEL_3 **asc);
@@ -3184,7 +3170,6 @@ BOOL make_spoolss_q_enumprinterdata(SPOOL_Q_ENUMPRINTERDATA *q_u,
 		const POLICY_HND *hnd,
 		uint32 idx, uint32 valuelen, uint32 datalen);
 BOOL spoolss_io_q_setprinterdata(char *desc, SPOOL_Q_SETPRINTERDATA *q_u, prs_struct *ps, int depth);
-void free_spoolss_q_setprinterdata(SPOOL_Q_SETPRINTERDATA *q_u);
 BOOL spoolss_io_r_setprinterdata(char *desc, SPOOL_R_SETPRINTERDATA *r_u, prs_struct *ps, int depth);
 BOOL convert_specific_param(NT_PRINTER_PARAM **param, const UNISTR2 *value,
 				uint32 type, const uint8 *data, uint32 len);
@@ -3200,10 +3185,6 @@ void free_devmode(DEVICEMODE *devmode);
 void free_printer_info_1(PRINTER_INFO_1 *printer);
 void free_printer_info_2(PRINTER_INFO_2 *printer);
 void free_printer_info_3(PRINTER_INFO_3 *printer);
-void free_spool_printer_info_1(SPOOL_PRINTER_INFO_LEVEL_1 *printer);
-void free_spool_printer_info_2(SPOOL_PRINTER_INFO_LEVEL_2 *printer);
-void free_spool_printer_info_3(SPOOL_PRINTER_INFO_LEVEL_3 *printer);
-void free_spool_printer_info_level(SPOOL_PRINTER_INFO_LEVEL *pil);
 void free_print2_array(uint32 num_entries, PRINTER_INFO_2 **entries);
 void free_print1_array(uint32 num_entries, PRINTER_INFO_1 **entries);
 void free_job1_array(uint32 num_entries, JOB_INFO_1 **entries);
@@ -3436,7 +3417,7 @@ BOOL convert_devicemode(char *printername, const DEVICEMODE *devmode,
 				NT_DEVICEMODE **pp_nt_devmode);
 uint32 _spoolss_closeprinter(POLICY_HND *handle);
 uint32 _spoolss_deleteprinter(POLICY_HND *handle);
-uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
+uint32 _spoolss_getprinterdata(pipes_struct *p, POLICY_HND *handle, UNISTR2 *valuename,
 				uint32 in_size,
 				uint32 *type,
 				uint32 *out_size,
@@ -3445,9 +3426,8 @@ uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
 uint32 _spoolss_rffpcnex(POLICY_HND *handle, uint32 flags, uint32 options,
 			 const UNISTR2 *localmachine, uint32 printerlocal,
 			 SPOOL_NOTIFY_OPTION *option);
-uint32 _spoolss_rfnpcnex( POLICY_HND *handle, uint32 change,
+uint32 _spoolss_rfnpcnex( pipes_struct *p, POLICY_HND *handle, uint32 change,
-			  SPOOL_NOTIFY_OPTION *option, TALLOC_CTX *mem_ctx,
+			  SPOOL_NOTIFY_OPTION *option, SPOOL_NOTIFY_INFO *info);
-			  SPOOL_NOTIFY_INFO *info);
 uint32 _spoolss_enumprinters( uint32 flags, const UNISTR2 *servername, uint32 level,
 			      NEW_BUFFER *buffer, uint32 offered,
 			      uint32 *needed, uint32 *returned);
@@ -3503,7 +3483,7 @@ uint32 _spoolss_addprinterdriver(pipes_struct *p, const UNISTR2 *server_name,
 uint32 _spoolss_getprinterdriverdirectory(UNISTR2 *name, UNISTR2 *uni_environment, uint32 level,
 					NEW_BUFFER *buffer, uint32 offered,
 					uint32 *needed);
-uint32 _spoolss_enumprinterdata(POLICY_HND *handle, uint32 idx,
+uint32 _spoolss_enumprinterdata(pipes_struct *p, POLICY_HND *handle, uint32 idx,
 				uint32 in_value_len, uint32 in_data_len,
 				uint32 *out_max_value_len, uint16 **out_value, uint32 *out_value_len,
 				uint32 *out_type,

source/include/rpc_secdes.h

@@ -105,6 +105,10 @@ typedef struct security_ace_info
 #define ACL_REVISION 0x3
 #endif
 
+#ifndef NT4_ACL_REVISION
+#define NT4_ACL_REVISION 0x2
+#endif
+
 #ifndef _SEC_ACL
 /* SEC_ACL */
 typedef struct security_acl_info
@@ -149,7 +153,7 @@ typedef struct security_descriptor_info
 typedef struct sec_desc_buf_info
 {
 	uint32 max_len;
-	uint32 undoc;
+	uint32 ptr;
 	uint32 len;
 
 	SEC_DESC *sec;

source/lib/talloc.c

@@ -139,3 +139,16 @@ void *talloc_zero(TALLOC_CTX *t, size_t size)
 
 	return p;
 }
+
+/* memdup with a talloc. */
+void *talloc_memdup(TALLOC_CTX *t, void *p, size_t size)
+{
+	void *newp = talloc(t,size);
+
+	if (!newp)
+		return 0;
+
+	memcpy(newp, p, size);
+
+	return newp;
+}

source/lib/util_seaccess.c

@@ -305,7 +305,7 @@ BOOL se_access_check(SEC_DESC *sd, struct current_user *user,
    the parent container.  This child object can either be a container or
    non-container object. */
 
-SEC_DESC_BUF *se_create_child_secdesc(SEC_DESC *parent_ctr, 
+SEC_DESC_BUF *se_create_child_secdesc(TALLOC_CTX *ctx, SEC_DESC *parent_ctr, 
 				      BOOL child_container)
 {
 	SEC_DESC_BUF *sdb;
@@ -321,7 +321,7 @@ SEC_DESC_BUF *se_create_child_secdesc(SEC_DESC *parent_ctr,
 
 	acl = parent_ctr->dacl;
 
-	if (!(new_ace_list = malloc(sizeof(SEC_ACE) * acl->num_aces))) 
+	if (!(new_ace_list = talloc(ctx, sizeof(SEC_ACE) * acl->num_aces))) 
 		return NULL;
 
 	for (i = 0; acl && i < acl->num_aces; i++) {
@@ -398,24 +398,19 @@ SEC_DESC_BUF *se_create_child_secdesc(SEC_DESC *parent_ctr,
 
 	/* Create child security descriptor to return */
 	
-	new_dacl = make_sec_acl(ACL_REVISION, new_ace_list_ndx, new_ace_list);
+	new_dacl = make_sec_acl(ctx, ACL_REVISION, new_ace_list_ndx, new_ace_list);
-	safe_free(new_ace_list);
 
 	/* Use the existing user and group sids.  I don't think this is
 	   correct.  Perhaps the user and group should be passed in as
 	   parameters by the caller? */
 
-	sd = make_sec_desc(SEC_DESC_REVISION,
+	sd = make_sec_desc(ctx, SEC_DESC_REVISION,
 			   parent_ctr->owner_sid,
 			   parent_ctr->grp_sid,
 			   parent_ctr->sacl,
 			   new_dacl, &size);
 
-	free_sec_acl(&new_dacl);
+	sdb = make_sec_desc_buf(ctx, size, sd);
-
-	sdb = make_sec_desc_buf(size, sd);
-
-	free_sec_desc(&sd);
 
 	return sdb;
 }

source/printing/nt_printing.c

@@ -2022,7 +2022,6 @@ static void free_nt_printer_info_level_2(NT_PRINTER_INFO_LEVEL_2 **info_ptr)
 	DEBUG(106,("free_nt_printer_info_level_2: deleting info\n"));
 
 	free_nt_devicemode(&info->devmode);
-	free_sec_desc_buf(&info->secdesc_buf);
 
 	for(param_ptr = info->specific; param_ptr; ) {
 		NT_PRINTER_PARAM *tofree = param_ptr;
@@ -2192,7 +2191,10 @@ static uint32 get_a_printer_2_default(NT_PRINTER_INFO_LEVEL_2 **info_ptr, fstrin
 		goto fail;
 #endif
 
-	if (!nt_printing_getsec(sharename, &info.secdesc_buf))
+	/* This will get the current RPC talloc context, but we should be
+	   passing this as a parameter... fixme... JRA ! */
+
+	if (!nt_printing_getsec(get_talloc_ctx(), sharename, &info.secdesc_buf))
 		goto fail;
 
 	*info_ptr = (NT_PRINTER_INFO_LEVEL_2 *)memdup(&info, sizeof(info));
@@ -2207,8 +2209,6 @@ static uint32 get_a_printer_2_default(NT_PRINTER_INFO_LEVEL_2 **info_ptr, fstrin
 
 	if (info.devmode)
 		free_nt_devicemode(&info.devmode);
-	if (info.secdesc_buf)
-		free_sec_desc_buf(&info.secdesc_buf);
 	return 2;
 }
 
@@ -2270,7 +2270,10 @@ static uint32 get_a_printer_2(NT_PRINTER_INFO_LEVEL_2 **info_ptr, fstring sharen
 	len += unpack_devicemode(&info.devmode,dbuf.dptr+len, dbuf.dsize-len);
 	len += unpack_specifics(&info.specific,dbuf.dptr+len, dbuf.dsize-len);
 
-	nt_printing_getsec(sharename, &info.secdesc_buf);
+	/* This will get the current RPC talloc context, but we should be
+       passing this as a parameter... fixme... JRA ! */
+
+	nt_printing_getsec(get_talloc_ctx(), sharename, &info.secdesc_buf);
 
 	safe_free(dbuf.dptr);
 	*info_ptr=memdup(&info, sizeof(info));
@@ -2651,7 +2654,7 @@ BOOL get_specific_param(NT_PRINTER_INFO_LEVEL printer, uint32 level,
 	/* right now that's enough ! */	
 	NT_PRINTER_PARAM *param;
 	
-	DEBUG(105, ("get_specific_param\n"));
+	DEBUG(10, ("get_specific_param\n"));
 	
 	param=printer.info_2->specific;
 		
@@ -2668,9 +2671,9 @@ BOOL get_specific_param(NT_PRINTER_INFO_LEVEL printer, uint32 level,
 		param=param->next;
 	}
 	
-	DEBUG(106, ("found one param\n"));
 	if (param != NULL)
 	{
+        DEBUGADD(10, ("get_specific_param: found one param\n"));
 		/* exited because it exist */
 		*type=param->type;	
 		
@@ -2680,10 +2683,10 @@ BOOL get_specific_param(NT_PRINTER_INFO_LEVEL printer, uint32 level,
 		memcpy(*data, param->data, param->data_len);
 		*len=param->data_len;
 
-		DEBUG(106, ("exit of get_specific_param:true\n"));
+		DEBUGADD(10, ("get_specific_param: exit true\n"));
 		return (True);
 	}
-	DEBUG(106, ("exit of get_specific_param:false\n"));
+	DEBUGADD(10, ("get_specific_param: exit false\n"));
 	return (False);
 }
 
@@ -2715,7 +2718,7 @@ uint32 nt_printing_setsec(char *printername, SEC_DESC_BUF *secdesc_ctr)
 		SEC_DESC *psd = NULL;
 		size_t size;
 
-		nt_printing_getsec(printername, &old_secdesc_ctr);
+		nt_printing_getsec(mem_ctx, printername, &old_secdesc_ctr);
 
 		/* Pick out correct owner and group sids */
 
@@ -2737,18 +2740,13 @@ uint32 nt_printing_setsec(char *printername, SEC_DESC_BUF *secdesc_ctr)
 
 		/* Make a deep copy of the security descriptor */
 
-		psd = make_sec_desc(secdesc_ctr->sec->revision,
+		psd = make_sec_desc(mem_ctx, secdesc_ctr->sec->revision,
 				    owner_sid, group_sid,
 				    sacl,
 				    dacl,
 				    &size);
 
-		new_secdesc_ctr = make_sec_desc_buf(size, psd);
+		new_secdesc_ctr = make_sec_desc_buf(mem_ctx, size, psd);
-
-		/* Free up memory */
-
-		free_sec_desc(&psd);
-		free_sec_desc_buf(&old_secdesc_ctr);
 	}
 
 	if (!new_secdesc_ctr) {
@@ -2778,11 +2776,6 @@ uint32 nt_printing_setsec(char *printername, SEC_DESC_BUF *secdesc_ctr)
 	/* Free mallocated memory */
 
  out:
-	free_sec_desc_buf(&old_secdesc_ctr);
-
-	if (new_secdesc_ctr != secdesc_ctr) {
-		free_sec_desc_buf(&new_secdesc_ctr);
-	}
 
 	prs_mem_free(&ps);
 	if (mem_ctx)
@@ -2794,7 +2787,7 @@ uint32 nt_printing_setsec(char *printername, SEC_DESC_BUF *secdesc_ctr)
  Construct a default security descriptor buffer for a printer.
 ****************************************************************************/
 
-static SEC_DESC_BUF *construct_default_printer_sdb(void)
+static SEC_DESC_BUF *construct_default_printer_sdb(TALLOC_CTX *ctx)
 {
 	SEC_ACE ace[3];
 	SEC_ACCESS sa;
@@ -2844,13 +2837,10 @@ static SEC_DESC_BUF *construct_default_printer_sdb(void)
 	   descriptors.  NT4 complains about the property being edited by a
 	   NT5 machine. */
 
-#define NT4_ACL_REVISION 0x2
+	if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, 3, ace)) != NULL) {
-
+		psd = make_sec_desc(ctx, SEC_DESC_REVISION,
-	if ((psa = make_sec_acl(NT4_ACL_REVISION, 3, ace)) != NULL) {
-		psd = make_sec_desc(SEC_DESC_REVISION,
 				    &owner_sid, NULL,
 				    NULL, psa, &sd_size);
-		free_sec_acl(&psa);
 	}
 
 	if (!psd) {
@@ -2858,12 +2848,11 @@ static SEC_DESC_BUF *construct_default_printer_sdb(void)
 		return NULL;
 	}
 
-	sdb = make_sec_desc_buf(sd_size, psd);
+	sdb = make_sec_desc_buf(ctx, sd_size, psd);
 
 	DEBUG(4,("construct_default_printer_sdb: size = %u.\n",
 		 (unsigned int)sd_size));
 
-	free_sec_desc(&psd);
 	return sdb;
 }
 
@@ -2871,17 +2860,12 @@ static SEC_DESC_BUF *construct_default_printer_sdb(void)
  Get a security desc for a printer.
 ****************************************************************************/
 
-BOOL nt_printing_getsec(char *printername, SEC_DESC_BUF **secdesc_ctr)
+BOOL nt_printing_getsec(TALLOC_CTX *ctx, char *printername, SEC_DESC_BUF **secdesc_ctr)
 {
 	prs_struct ps;
-	TALLOC_CTX *mem_ctx = NULL;
 	fstring key;
 	char *temp;
 
-	mem_ctx = talloc_init();
-	if (mem_ctx == NULL)
-		return False;
-
 	if ((temp = strchr(printername + 2, '\\'))) {
 		printername = temp + 1;
 	}
@@ -2890,17 +2874,15 @@ BOOL nt_printing_getsec(char *printername, SEC_DESC_BUF **secdesc_ctr)
 
 	slprintf(key, sizeof(key), "SECDESC/%s", printername);
 
-	if (tdb_prs_fetch(tdb, key, &ps, mem_ctx)!=0 ||
+	if (tdb_prs_fetch(tdb, key, &ps, ctx)!=0 ||
 	    !sec_io_desc_buf("nt_printing_getsec", secdesc_ctr, &ps, 1)) {
 
 		DEBUG(4,("using default secdesc for %s\n", printername));
 
-		if (!(*secdesc_ctr = construct_default_printer_sdb())) {
+		if (!(*secdesc_ctr = construct_default_printer_sdb(ctx))) {
-			talloc_destroy(mem_ctx);
 			return False;
 		}
 
-		talloc_destroy(mem_ctx);
 		return True;
 	}
 
@@ -2924,20 +2906,17 @@ BOOL nt_printing_getsec(char *printername, SEC_DESC_BUF **secdesc_ctr)
 
 			sid_append_rid(&owner_sid, DOMAIN_USER_RID_ADMIN);
 
-			psd = make_sec_desc((*secdesc_ctr)->sec->revision,
+			psd = make_sec_desc(ctx, (*secdesc_ctr)->sec->revision,
 					    &owner_sid,
 					    (*secdesc_ctr)->sec->grp_sid,
 					    (*secdesc_ctr)->sec->sacl,
 					    (*secdesc_ctr)->sec->dacl,
 					    &size);
 
-			new_secdesc_ctr = make_sec_desc_buf(size, psd);
+			new_secdesc_ctr = make_sec_desc_buf(ctx, size, psd);
-
-			free_sec_desc(&psd);
 
 			/* Swap with other one */
 
-			free_sec_desc_buf(secdesc_ctr);
 			*secdesc_ctr = new_secdesc_ctr;
 
 			/* Set it */
@@ -2965,7 +2944,6 @@ BOOL nt_printing_getsec(char *printername, SEC_DESC_BUF **secdesc_ctr)
 	}
 
 	prs_mem_free(&ps);
-	talloc_destroy(mem_ctx);
 	return True;
 }
 
@@ -3043,6 +3021,7 @@ BOOL print_access_check(struct current_user *user, int snum, int access_type)
 	uint32 access_granted, status;
 	BOOL result;
 	char *pname;
+	TALLOC_CTX *mem_ctx = NULL;
 	extern struct current_user current_user;
 	
 	/* If user is NULL then use the current_user structure */
@@ -3067,7 +3046,12 @@ BOOL print_access_check(struct current_user *user, int snum, int access_type)
 
 	/* Get printer security descriptor */
 
-	nt_printing_getsec(pname, &secdesc);
+	if(!(mem_ctx = talloc_init())) {
+		errno = ENOMEM;
+		return False;
+	}
+
+	nt_printing_getsec(mem_ctx, pname, &secdesc);
 
 	if (access_type == JOB_ACCESS_ADMINISTER) {
 		SEC_DESC_BUF *parent_secdesc = secdesc;
@@ -3076,9 +3060,7 @@ BOOL print_access_check(struct current_user *user, int snum, int access_type)
 		   against.  This is because print jobs are child objects
 		   objects of a printer. */
 
-		secdesc = se_create_child_secdesc(parent_secdesc->sec, False);
+		secdesc = se_create_child_secdesc(mem_ctx, parent_secdesc->sec, False);
-
-		free_sec_desc_buf(&parent_secdesc);
 
 		/* Now this is the bit that really confuses me.  The access
 		   type needs to be changed from JOB_ACCESS_ADMINISTER to
@@ -3097,11 +3079,9 @@ BOOL print_access_check(struct current_user *user, int snum, int access_type)
 				 &access_granted, &status);
 
 	DEBUG(4, ("access check was %s\n", result ? "SUCCESS" : "FAILURE"));
+
+	talloc_destroy(mem_ctx);
 	
-	/* Free mallocated memory */
-
-	free_sec_desc_buf(&secdesc);
-
 	if (!result)
 		errno = EACCES;
 
@@ -3215,5 +3195,4 @@ uint32 printer_write_default_dev(int snum, const PRINTER_DEFAULT *printer_defaul
 	free_a_printer(&printer, 2);
 	return result;
 }
-
 #undef OLD_NTDOMAIN

source/rpc_client/cli_reg.c

@@ -708,19 +708,17 @@ BOOL do_reg_create_key(struct cli_state *cli, POLICY_HND *hnd,
 	DEBUG(4,("REG Create Key: %s %s 0x%08x\n", key_name, key_class,
 		sam_access != NULL ? sam_access->mask : 0));
 
-	if((sec = make_sec_desc( 1, NULL, NULL, NULL, NULL, &sec_len)) == NULL) {
+	if((sec = make_sec_desc( cli->mem_ctx, 1, NULL, NULL, NULL, NULL, &sec_len)) == NULL) {
 		DEBUG(0,("make_sec_desc : malloc fail.\n"));
 		return False;
 	}
 
 	DEBUG(10,("make_sec_desc: len = %d\n", (int)sec_len));
 
-	if((sec_buf = make_sec_desc_buf( (int)sec_len, sec)) == NULL) {
+	if((sec_buf = make_sec_desc_buf( cli->mem_ctx, (int)sec_len, sec)) == NULL) {
 		DEBUG(0,("make_sec_desc : malloc fail (1)\n"));
-		free_sec_desc(&sec);
 		return False;
 	}
-	free_sec_desc(&sec);
 
 	prs_init(&buf, MAX_PDU_FRAG_LEN, 4, cli->mem_ctx, MARSHALL);
 	prs_init(&rbuf, 0, 4, cli->mem_ctx, UNMARSHALL);
@@ -729,7 +727,6 @@ BOOL do_reg_create_key(struct cli_state *cli, POLICY_HND *hnd,
 
 	/* turn parameters into data stream */
 	if(!reg_io_q_create_key("", &q_o, &buf, 0)) {
-		free_sec_desc_buf(&sec_buf);
 		prs_mem_free(&buf);
 		prs_mem_free(&rbuf);
 		return False;
@@ -737,13 +734,11 @@ BOOL do_reg_create_key(struct cli_state *cli, POLICY_HND *hnd,
 
 	/* send the data on \PIPE\ */
 	if (rpc_api_pipe_req(cli, REG_CREATE_KEY, &buf, &rbuf)) {
-		free_sec_desc_buf(&sec_buf);
 		prs_mem_free(&buf);
 		prs_mem_free(&rbuf);
 		return False;
 	}
 
-	free_sec_desc_buf(&sec_buf);
 	prs_mem_free(&buf);
 
 	ZERO_STRUCT(r_o);

source/rpc_client/cli_spoolss.c

@@ -584,7 +584,6 @@ BOOL spoolss_addprinterex(POLICY_HND *hnd, const char* srv_name, PRINTER_INFO_2
 
         prs_mem_free(&rbuf);
         prs_mem_free(&buf );
-	free_spoolss_q_addprinterex(&q_o);
 
 	if (mem_ctx)
 		talloc_destroy(mem_ctx);
@@ -813,7 +812,6 @@ uint32 spoolss_addprinterdriver(const char *srv_name, uint32 level, PRINTER_DRIV
 
         prs_mem_free(&rbuf);
         prs_mem_free(&buf );
-	free_spool_driver_info_3(q_o.info.info_3);
 
 	if (mem_ctx)
 		talloc_destroy(mem_ctx);

source/rpc_parse/parse_sec.c

@@ -123,22 +123,19 @@ BOOL sec_io_ace(char *desc, SEC_ACE *psa, prs_struct *ps, int depth)
  Create a SEC_ACL structure.  
 ********************************************************************/
 
-SEC_ACL *make_sec_acl(uint16 revision, int num_aces, SEC_ACE *ace_list)
+SEC_ACL *make_sec_acl(TALLOC_CTX *ctx, uint16 revision, int num_aces, SEC_ACE *ace_list)
 {
 	SEC_ACL *dst;
 	int i;
 
-	if((dst = (SEC_ACL *)malloc(sizeof(SEC_ACL))) == NULL)
+	if((dst = (SEC_ACL *)talloc_zero(ctx,sizeof(SEC_ACL))) == NULL)
 		return NULL;
 
-	ZERO_STRUCTP(dst);
-
 	dst->revision = revision;
 	dst->num_aces = num_aces;
 	dst->size = 8;
 
-	if((dst->ace = (SEC_ACE *)malloc( sizeof(SEC_ACE) * num_aces )) == NULL) {
+	if((dst->ace = (SEC_ACE *)talloc(ctx, sizeof(SEC_ACE) * num_aces )) == NULL) {
-		free_sec_acl(&dst);
 		return NULL;
 	}
 
@@ -154,31 +151,12 @@ SEC_ACL *make_sec_acl(uint16 revision, int num_aces, SEC_ACE *ace_list)
  Duplicate a SEC_ACL structure.  
 ********************************************************************/
 
-SEC_ACL *dup_sec_acl( SEC_ACL *src)
+SEC_ACL *dup_sec_acl(TALLOC_CTX *ctx, SEC_ACL *src)
 {
 	if(src == NULL)
 		return NULL;
 
-	return make_sec_acl( src->revision, src->num_aces, src->ace);
+	return make_sec_acl(ctx, src->revision, src->num_aces, src->ace);
-}
-
-/*******************************************************************
- Delete a SEC_ACL structure.  
-********************************************************************/
-
-void free_sec_acl(SEC_ACL **ppsa)
-{
-	SEC_ACL *psa;
-
-	if(ppsa == NULL || *ppsa == NULL)
-		return;
-
-	psa = *ppsa;
-	if (psa->ace != NULL)
-		free(psa->ace);
-
-	free(psa);
-	*ppsa = NULL;
 }
 
 /*******************************************************************
@@ -204,7 +182,7 @@ BOOL sec_io_acl(char *desc, SEC_ACL **ppsa, prs_struct *ps, int depth)
 		/*
 		 * This is a read and we must allocate the stuct to read into.
 		 */
-		if((psa = (SEC_ACL *)malloc(sizeof(SEC_ACL))) == NULL)
+		if((psa = (SEC_ACL *)prs_alloc_mem(ps, sizeof(SEC_ACL))) == NULL)
 			return False;
 		*ppsa = psa;
 	}
@@ -228,7 +206,7 @@ BOOL sec_io_acl(char *desc, SEC_ACL **ppsa, prs_struct *ps, int depth)
 
 	if (UNMARSHALLING(ps) && psa->num_aces != 0) {
 		/* reading */
-		if((psa->ace = malloc(sizeof(psa->ace[0]) * psa->num_aces)) == NULL)
+		if((psa->ace = (SEC_ACE *)prs_alloc_mem(ps,sizeof(psa->ace[0]) * psa->num_aces)) == NULL)
 			return False;
 	}
 
@@ -423,7 +401,7 @@ BOOL sec_desc_equal(SEC_DESC *s1, SEC_DESC *s2)
  security descriptor new_sec.
 ********************************************************************/
 
-SEC_DESC_BUF *sec_desc_merge(SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb)
+SEC_DESC_BUF *sec_desc_merge(TALLOC_CTX *ctx, SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb)
 {
 	DOM_SID *owner_sid, *group_sid;
 	SEC_DESC_BUF *return_sdb;
@@ -460,21 +438,37 @@ SEC_DESC_BUF *sec_desc_merge(SEC_DESC_BUF *new_sdb, SEC_DESC_BUF *old_sdb)
 
 	/* Create new security descriptor from bits */
 
-	psd = make_sec_desc(new_sdb->sec->revision, 
+	psd = make_sec_desc(ctx, new_sdb->sec->revision, 
 			    owner_sid, group_sid, sacl, dacl, &secdesc_size);
 
-	return_sdb = make_sec_desc_buf(secdesc_size, psd);
+	return_sdb = make_sec_desc_buf(ctx, secdesc_size, psd);
-
-	free_sec_desc(&psd);
 
 	return(return_sdb);
 }
 
+/*******************************************************************
+ Tallocs a duplicate SID. 
+********************************************************************/ 
+
+static DOM_SID *sid_dup_talloc(TALLOC_CTX *ctx, DOM_SID *src)
+{
+  DOM_SID *dst;
+
+  if(!src)
+    return NULL;
+
+  if((dst = talloc_zero(ctx, sizeof(DOM_SID))) != NULL) {
+    sid_copy( dst, src);
+  }
+
+  return dst;
+}
+
 /*******************************************************************
  Creates a SEC_DESC structure
 ********************************************************************/
 
-SEC_DESC *make_sec_desc(uint16 revision, 
+SEC_DESC *make_sec_desc(TALLOC_CTX *ctx, uint16 revision, 
 			DOM_SID *owner_sid, DOM_SID *grp_sid,
 			SEC_ACL *sacl, SEC_ACL *dacl, size_t *sd_size)
 {
@@ -483,11 +477,9 @@ SEC_DESC *make_sec_desc(uint16 revision,
 
 	*sd_size = 0;
 
-	if(( dst = (SEC_DESC *)malloc(sizeof(SEC_DESC))) == NULL)
+	if(( dst = (SEC_DESC *)talloc_zero(ctx, sizeof(SEC_DESC))) == NULL)
 		return NULL;
 
-	ZERO_STRUCTP(dst);
-
 	dst->revision = revision;
 	dst->type     = SEC_DESC_SELF_RELATIVE;
 
@@ -499,16 +491,16 @@ SEC_DESC *make_sec_desc(uint16 revision,
 	dst->off_sacl      = 0;
 	dst->off_dacl      = 0;
 
-	if(owner_sid && ((dst->owner_sid = sid_dup(owner_sid)) == NULL))
+	if(owner_sid && ((dst->owner_sid = sid_dup_talloc(ctx,owner_sid)) == NULL))
 		goto error_exit;
 
-	if(grp_sid && ((dst->grp_sid = sid_dup(grp_sid)) == NULL))
+	if(grp_sid && ((dst->grp_sid = sid_dup_talloc(ctx,grp_sid)) == NULL))
 		goto error_exit;
 
-	if(sacl && ((dst->sacl = dup_sec_acl(sacl)) == NULL))
+	if(sacl && ((dst->sacl = dup_sec_acl(ctx, sacl)) == NULL))
 		goto error_exit;
 
-	if(dacl && ((dst->dacl = dup_sec_acl(dacl)) == NULL))
+	if(dacl && ((dst->dacl = dup_sec_acl(ctx, dacl)) == NULL))
 		goto error_exit;
 		
 	offset = 0;
@@ -559,7 +551,6 @@ SEC_DESC *make_sec_desc(uint16 revision,
 error_exit:
 
 	*sd_size = 0;
-	free_sec_desc(&dst);
 	return NULL;
 }
 
@@ -567,47 +558,26 @@ error_exit:
  Duplicate a SEC_DESC structure.  
 ********************************************************************/
 
-SEC_DESC *dup_sec_desc( SEC_DESC *src)
+SEC_DESC *dup_sec_desc( TALLOC_CTX *ctx, SEC_DESC *src)
 {
 	size_t dummy;
 
 	if(src == NULL)
 		return NULL;
 
-	return make_sec_desc( src->revision, 
+	return make_sec_desc( ctx, src->revision, 
 				src->owner_sid, src->grp_sid, src->sacl,
 				src->dacl, &dummy);
 }
 
-/*******************************************************************
- Deletes a SEC_DESC structure
-********************************************************************/
-
-void free_sec_desc(SEC_DESC **ppsd)
-{
-	SEC_DESC *psd;
-
-	if(ppsd == NULL || *ppsd == NULL)
-		return;
-
-	psd = *ppsd;
-
-	free_sec_acl(&psd->dacl);
-	free_sec_acl(&psd->sacl);
-	free(psd->owner_sid);
-	free(psd->grp_sid);
-	free(psd);
-	*ppsd = NULL;
-}
-
 /*******************************************************************
  Creates a SEC_DESC structure with typical defaults.
 ********************************************************************/
 
-SEC_DESC *make_standard_sec_desc(DOM_SID *owner_sid, DOM_SID *grp_sid,
+SEC_DESC *make_standard_sec_desc(TALLOC_CTX *ctx, DOM_SID *owner_sid, DOM_SID *grp_sid,
 				 SEC_ACL *dacl, size_t *sd_size)
 {
-	return make_sec_desc(SEC_DESC_REVISION,
+	return make_sec_desc(ctx, SEC_DESC_REVISION,
 			     owner_sid, grp_sid, NULL, dacl, sd_size);
 }
 
@@ -629,7 +599,7 @@ BOOL sec_io_desc(char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth)
 
 	if (psd == NULL) {
 		if(UNMARSHALLING(ps)) {
-			if((psd = (SEC_DESC *)malloc(sizeof(SEC_DESC))) == NULL)
+			if((psd = (SEC_DESC *)prs_alloc_mem(ps,sizeof(SEC_DESC))) == NULL)
 				return False;
 			*ppsd = psd;
 		} else {
@@ -673,7 +643,7 @@ BOOL sec_io_desc(char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth)
 			if(!prs_set_offset(ps, old_offset + psd->off_owner_sid))
 				return False;
 			/* reading */
-			if((psd->owner_sid = malloc(sizeof(*psd->owner_sid))) == NULL)
+			if((psd->owner_sid = (DOM_SID *)prs_alloc_mem(ps,sizeof(*psd->owner_sid))) == NULL)
 				return False;
 		}
 
@@ -691,7 +661,7 @@ BOOL sec_io_desc(char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth)
 			/* reading */
 			if(!prs_set_offset(ps, old_offset + psd->off_grp_sid))
 				return False;
-			if((psd->grp_sid = malloc(sizeof(*psd->grp_sid))) == NULL)
+			if((psd->grp_sid = (DOM_SID *)prs_alloc_mem(ps,sizeof(*psd->grp_sid))) == NULL)
 				return False;
 		}
 
@@ -734,24 +704,23 @@ BOOL sec_io_desc(char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth)
  Creates a SEC_DESC_BUF structure.
 ********************************************************************/
 
-SEC_DESC_BUF *make_sec_desc_buf(size_t len, SEC_DESC *sec_desc)
+SEC_DESC_BUF *make_sec_desc_buf(TALLOC_CTX *ctx, size_t len, SEC_DESC *sec_desc)
 {
 	SEC_DESC_BUF *dst;
 
-	if((dst = (SEC_DESC_BUF *)malloc(sizeof(SEC_DESC_BUF))) == NULL)
+	if((dst = (SEC_DESC_BUF *)talloc_zero(ctx, sizeof(SEC_DESC_BUF))) == NULL)
 		return NULL;
 
-	ZERO_STRUCTP(dst);
-
 	/* max buffer size (allocated size) */
 	dst->max_len = (uint32)len;
 	dst->len = (uint32)len;
-
+	
-	if(sec_desc && ((dst->sec = dup_sec_desc(sec_desc)) == NULL)) {
+	if(sec_desc && ((dst->sec = dup_sec_desc(ctx, sec_desc)) == NULL)) {
-		free_sec_desc_buf(&dst);
 		return NULL;
 	}
 
+	dst->ptr = 0x1;
+
 	return dst;
 }
 
@@ -759,32 +728,14 @@ SEC_DESC_BUF *make_sec_desc_buf(size_t len, SEC_DESC *sec_desc)
  Duplicates a SEC_DESC_BUF structure.
 ********************************************************************/
 
-SEC_DESC_BUF *dup_sec_desc_buf(SEC_DESC_BUF *src)
+SEC_DESC_BUF *dup_sec_desc_buf(TALLOC_CTX *ctx, SEC_DESC_BUF *src)
 {
 	if(src == NULL)
 		return NULL;
 
-	return make_sec_desc_buf( src->len, src->sec);
+	return make_sec_desc_buf( ctx, src->len, src->sec);
 }
 
-/*******************************************************************
- Deletes a SEC_DESC_BUF structure.
-********************************************************************/
-
-void free_sec_desc_buf(SEC_DESC_BUF **ppsdb)
-{
-	SEC_DESC_BUF *psdb;
-
-	if(ppsdb == NULL || *ppsdb == NULL)
-		return;
-
-	psdb = *ppsdb;
-	free_sec_desc(&psdb->sec);
-	free(psdb);
-	*ppsdb = NULL;
-}
-
-
 /*******************************************************************
  Reads or writes a SEC_DESC_BUF structure.
 ********************************************************************/
@@ -803,7 +754,7 @@ BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int depth
 	psdb = *ppsdb;
 
 	if (UNMARSHALLING(ps) && psdb == NULL) {
-		if((psdb = (SEC_DESC_BUF *)malloc(sizeof(SEC_DESC_BUF))) == NULL)
+		if((psdb = (SEC_DESC_BUF *)prs_alloc_mem(ps,sizeof(SEC_DESC_BUF))) == NULL)
 			return False;
 		*ppsdb = psdb;
 	}
@@ -817,7 +768,7 @@ BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int depth
 	if(!prs_uint32_pre("max_len", ps, depth, &psdb->max_len, &off_max_len))
 		return False;
 
-	if(!prs_uint32    ("undoc  ", ps, depth, &psdb->undoc))
+	if(!prs_uint32    ("ptr  ", ps, depth, &psdb->ptr))
 		return False;
 
 	if(!prs_uint32_pre("len    ", ps, depth, &psdb->len, &off_len))

source/rpc_server/srv_spoolss.c

@@ -53,9 +53,6 @@ static BOOL api_spoolss_open_printer_ex(pipes_struct *p)
 	                                       q_u.user_switch, q_u.user_ctr,
 	                                       &r_u.handle);
 
-	/* we _really_ need to switch to talloc() */
-	free_spoolss_q_open_printer_ex(&q_u);
-
 	if (!spoolss_io_r_open_printer_ex("",&r_u,rdata,0)){
 		DEBUG(0,("spoolss_io_r_open_printer_ex: unable to marshall SPOOL_R_OPEN_PRINTER_EX.\n"));
 		return False;
@@ -85,7 +82,7 @@ static BOOL api_spoolss_getprinterdata(pipes_struct *p)
 		return False;
 	}
 	
-	r_u.status = _spoolss_getprinterdata( &q_u.handle, &q_u.valuename,
+	r_u.status = _spoolss_getprinterdata( p, &q_u.handle, &q_u.valuename,
 	                                      q_u.size, &r_u.type, &r_u.size,
 	                                      &r_u.data, &r_u.needed);
 
@@ -94,8 +91,6 @@ static BOOL api_spoolss_getprinterdata(pipes_struct *p)
 		return False;
 	}
 
-	safe_free(r_u.data);
-
 	return True;
 }
 
@@ -277,9 +272,7 @@ static BOOL api_spoolss_rfnpcnex(pipes_struct *p)
 	}
 
 	r_u.status = _spoolss_rfnpcnex(&q_u.handle, q_u.change,
-	                               q_u.option, data->mem_ctx, &r_u.info);
+	                               q_u.option, p->mem_ctx, &r_u.info);
-
-	safe_free(q_u.option);
 
 	/* we always have a NOTIFY_INFO struct */
 	r_u.info_ptr=0x1;
@@ -289,8 +282,6 @@ static BOOL api_spoolss_rfnpcnex(pipes_struct *p)
 		return False;
 	}
 
-	safe_free(r_u.info.data);
-
 	return True;
 }
 
@@ -310,9 +301,6 @@ static BOOL api_spoolss_enumprinters(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumprinters("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprinters: unable to unmarshall SPOOL_Q_ENUMPRINTERS.\n"));
 		return False;
@@ -327,12 +315,9 @@ static BOOL api_spoolss_enumprinters(pipes_struct *p)
 
 	if (!new_spoolss_io_r_enumprinters("", &r_u, rdata, 0)) {
 		DEBUG(0,("new_spoolss_io_r_enumprinters: unable to marshall SPOOL_R_ENUMPRINTERS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -351,9 +336,6 @@ static BOOL api_spoolss_getprinter(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_getprinter("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getprinter: unable to unmarshall SPOOL_Q_GETPRINTER.\n"));
 		return False;
@@ -368,11 +350,9 @@ static BOOL api_spoolss_getprinter(pipes_struct *p)
 
 	if(!spoolss_io_r_getprinter("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_getprinter: unable to marshall SPOOL_R_GETPRINTER.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
 	return True;
 }
 
@@ -392,9 +372,6 @@ static BOOL api_spoolss_getprinterdriver2(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_getprinterdriver2("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getprinterdriver2: unable to unmarshall SPOOL_Q_GETPRINTERDRIVER2.\n"));
 		return False;
@@ -410,11 +387,9 @@ static BOOL api_spoolss_getprinterdriver2(pipes_struct *p)
 	
 	if(!spoolss_io_r_getprinterdriver2("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_getprinterdriver2: unable to marshall SPOOL_R_GETPRINTERDRIVER2.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 	
-	new_spoolss_free_buffer(q_u.buffer);
 	return True;
 }
 
@@ -560,7 +535,6 @@ static BOOL api_spoolss_writeprinter(pipes_struct *p)
 	                                   q_u.buffer,
 	                                   &q_u.buffer_size2);
 	r_u.buffer_written = q_u.buffer_size2;
-	safe_free(q_u.buffer);
 
 	if(!spoolss_io_r_writeprinter("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_writeprinter: unable to marshall SPOOL_R_WRITEPRINTER.\n"));
@@ -594,13 +568,9 @@ static BOOL api_spoolss_setprinter(pipes_struct *p)
 	
 	if(!spoolss_io_r_setprinter("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_setprinter: unable to marshall SPOOL_R_SETPRINTER.\n"));
-		free_spoolss_q_setprinter(&q_u);
 		return False;
 	}
 
-	/* Free anything allocated in the unparse. */
-	free_spoolss_q_setprinter(&q_u);
-
 	return True;
 }
 
@@ -644,9 +614,6 @@ static BOOL api_spoolss_addjob(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_addjob("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_addjob: unable to unmarshall SPOOL_Q_ADDJOB.\n"));
 		return False;
@@ -660,12 +627,9 @@ static BOOL api_spoolss_addjob(pipes_struct *p)
 		
 	if(!spoolss_io_r_addjob("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_addjob: unable to marshall SPOOL_R_ADDJOB.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;		
 }
 
@@ -682,9 +646,6 @@ static BOOL api_spoolss_enumjobs(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumjobs("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumjobs: unable to unmarshall SPOOL_Q_ENUMJOBS.\n"));
 		return False;
@@ -699,12 +660,9 @@ static BOOL api_spoolss_enumjobs(pipes_struct *p)
 
 	if (!spoolss_io_r_enumjobs("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_enumjobs: unable to marshall SPOOL_R_ENUMJOBS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -777,9 +735,6 @@ static BOOL api_spoolss_enumprinterdrivers(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumprinterdrivers("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprinterdrivers: unable to unmarshall SPOOL_Q_ENUMPRINTERDRIVERS.\n"));
 		return False;
@@ -794,12 +749,9 @@ static BOOL api_spoolss_enumprinterdrivers(pipes_struct *p)
 
 	if (!new_spoolss_io_r_enumprinterdrivers("",&r_u,rdata,0)) {
 		DEBUG(0,("new_spoolss_io_r_enumprinterdrivers: unable to marshall SPOOL_R_ENUMPRINTERDRIVERS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -816,9 +768,6 @@ static BOOL api_spoolss_getform(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_getform("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getform: unable to unmarshall SPOOL_Q_GETFORM.\n"));
 		return False;
@@ -832,12 +781,9 @@ static BOOL api_spoolss_getform(pipes_struct *p)
 
 	if (!new_spoolss_io_r_getform("",&r_u,rdata,0)) {
 		DEBUG(0,("new_spoolss_io_r_getform: unable to marshall SPOOL_R_GETFORM.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -853,9 +799,6 @@ static BOOL api_spoolss_enumforms(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumforms("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumforms: unable to unmarshall SPOOL_Q_ENUMFORMS.\n"));
 		return False;
@@ -870,12 +813,9 @@ static BOOL api_spoolss_enumforms(pipes_struct *p)
 
 	if (!new_spoolss_io_r_enumforms("",&r_u,rdata,0)) {
 		DEBUG(0,("new_spoolss_io_r_enumforms: unable to marshall SPOOL_R_ENUMFORMS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -892,9 +832,6 @@ static BOOL api_spoolss_enumports(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_enumports("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumports: unable to unmarshall SPOOL_Q_ENUMPORTS.\n"));
 		return False;
@@ -909,12 +846,9 @@ static BOOL api_spoolss_enumports(pipes_struct *p)
 
 	if (!new_spoolss_io_r_enumports("",&r_u,rdata,0)) {
 		DEBUG(0,("new_spoolss_io_r_enumports: unable to marshall SPOOL_R_ENUMPORTS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -947,17 +881,6 @@ static BOOL api_spoolss_addprinterex(pipes_struct *p)
 		return False;
 	}
 	
-	if (q_u.info.info_ptr!=0) {
-		switch (q_u.info.level) {
-			case 1:
-				safe_free(q_u.info.info_1);
-				break;
-			case 2:
-				safe_free(q_u.info.info_2);
-				break;
-		}
-	}
-		
 	return True;
 }
 
@@ -975,7 +898,6 @@ static BOOL api_spoolss_addprinterdriver(pipes_struct *p)
 	
 	if(!spoolss_io_q_addprinterdriver("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_addprinterdriver: unable to unmarshall SPOOL_Q_ADDPRINTERDRIVER.\n"));
-		free_spoolss_q_addprinterdriver(&q_u);
 		return False;
 	}
 	
@@ -983,12 +905,9 @@ static BOOL api_spoolss_addprinterdriver(pipes_struct *p)
 				
 	if(!spoolss_io_r_addprinterdriver("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_addprinterdriver: unable to marshall SPOOL_R_ADDPRINTERDRIVER.\n"));
-		free_spoolss_q_addprinterdriver(&q_u);
 		return False;
 	}
 	
-	free_spoolss_q_addprinterdriver(&q_u);
-
 	return True;
 }
 
@@ -1004,9 +923,6 @@ static BOOL api_spoolss_getprinterdriverdirectory(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_getprinterdriverdir("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getprinterdriverdir: unable to unmarshall SPOOL_Q_GETPRINTERDRIVERDIR.\n"));
 		return False;
@@ -1021,12 +937,9 @@ static BOOL api_spoolss_getprinterdriverdirectory(pipes_struct *p)
 
 	if(!spoolss_io_r_getprinterdriverdir("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_getprinterdriverdir: unable to marshall SPOOL_R_GETPRINTERDRIVERDIR.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 
-	new_spoolss_free_buffer(q_u.buffer);
-
 	return True;
 }
 
@@ -1047,21 +960,16 @@ static BOOL api_spoolss_enumprinterdata(pipes_struct *p)
 		return False;
 	}
 	
-	r_u.status = _spoolss_enumprinterdata(&q_u.handle, q_u.index, q_u.valuesize, q_u.datasize,
+	r_u.status = _spoolss_enumprinterdata(p, &q_u.handle, q_u.index, q_u.valuesize, q_u.datasize,
 						&r_u.valuesize, &r_u.value, &r_u.realvaluesize,
 						&r_u.type,
 						&r_u.datasize, &r_u.data, &r_u.realdatasize);
 				
 	if(!spoolss_io_r_enumprinterdata("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_enumprinterdata: unable to marshall SPOOL_R_ENUMPRINTERDATA.\n"));
-		safe_free(r_u.value);
-		safe_free(r_u.data);
 		return False;
 	}
 
-	safe_free(r_u.value);
-	safe_free(r_u.data);
-
 	return True;
 }
 
@@ -1086,8 +994,6 @@ static BOOL api_spoolss_setprinterdata(pipes_struct *p)
 				&q_u.value, q_u.type, q_u.max_len,
 				q_u.data, q_u.real_len, q_u.numeric_data);
 				
-	free_spoolss_q_setprinterdata(&q_u);
-
 	if(!spoolss_io_r_setprinterdata("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_setprinterdata: unable to marshall SPOOL_R_SETPRINTERDATA.\n"));
 		return False;
@@ -1189,9 +1095,6 @@ static BOOL api_spoolss_enumprintprocessors(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 	
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_enumprintprocessors("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprintprocessors: unable to unmarshall SPOOL_Q_ENUMPRINTPROCESSORS.\n"));
 		return False;
@@ -1206,12 +1109,9 @@ static BOOL api_spoolss_enumprintprocessors(pipes_struct *p)
 
 	if(!spoolss_io_r_enumprintprocessors("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_enumprintprocessors: unable to marshall SPOOL_R_ENUMPRINTPROCESSORS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 	
-	new_spoolss_free_buffer(q_u.buffer);
-	
 	return True;
 }
 
@@ -1227,9 +1127,6 @@ static BOOL api_spoolss_enumprintprocdatatypes(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 	
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_enumprintprocdatatypes("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprintprocdatatypes: unable to unmarshall SPOOL_Q_ENUMPRINTPROCDATATYPES.\n"));
 		return False;
@@ -1244,12 +1141,9 @@ static BOOL api_spoolss_enumprintprocdatatypes(pipes_struct *p)
 
 	if(!spoolss_io_r_enumprintprocdatatypes("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_enumprintprocdatatypes: unable to marshall SPOOL_R_ENUMPRINTPROCDATATYPES.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 	
-	new_spoolss_free_buffer(q_u.buffer);
-	
 	return True;
 }
 
@@ -1265,9 +1159,6 @@ static BOOL api_spoolss_enumprintmonitors(pipes_struct *p)
 	ZERO_STRUCT(q_u);
 	ZERO_STRUCT(r_u);
 	
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if (!spoolss_io_q_enumprintmonitors("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_enumprintmonitors: unable to unmarshall SPOOL_Q_ENUMPRINTMONITORS.\n"));
 		return False;
@@ -1282,12 +1173,9 @@ static BOOL api_spoolss_enumprintmonitors(pipes_struct *p)
 
 	if (!spoolss_io_r_enumprintmonitors("", &r_u, rdata, 0)) {
 		DEBUG(0,("spoolss_io_r_enumprintmonitors: unable to marshall SPOOL_R_ENUMPRINTMONITORS.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 	
-	new_spoolss_free_buffer(q_u.buffer);
-	
 	return True;
 }
 
@@ -1300,9 +1188,6 @@ static BOOL api_spoolss_getjob(pipes_struct *p)
 	prs_struct *data = &p->in_data.data;
 	prs_struct *rdata = &p->out_data.rdata;
 	
-	if(!new_spoolss_allocate_buffer(&q_u.buffer))
-		return False;
-
 	if(!spoolss_io_q_getjob("", &q_u, data, 0)) {
 		DEBUG(0,("spoolss_io_q_getjob: unable to unmarshall SPOOL_Q_GETJOB.\n"));
 		return False;
@@ -1317,11 +1202,9 @@ static BOOL api_spoolss_getjob(pipes_struct *p)
 	
 	if(!spoolss_io_r_getjob("",&r_u,rdata,0)) {
 		DEBUG(0,("spoolss_io_r_getjob: unable to marshall SPOOL_R_GETJOB.\n"));
-		new_spoolss_free_buffer(q_u.buffer);
 		return False;
 	}
 		
-	new_spoolss_free_buffer(q_u.buffer);
 	return True;
 }
 

source/rpc_server/srv_spoolss_nt.c

@@ -1155,7 +1155,7 @@ static BOOL getprinterdata_printer(POLICY_HND *handle,
 /********************************************************************
  * spoolss_getprinterdata
  ********************************************************************/
-uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
+uint32 _spoolss_getprinterdata(pipes_struct *p, POLICY_HND *handle, UNISTR2 *valuename,
 				uint32 in_size,
 				uint32 *type,
 				uint32 *out_size,
@@ -1199,9 +1199,8 @@ uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
 		DEBUG(5, ("value not found, allocating %d\n", *out_size));
 		/* reply this param doesn't exist */
 		if (*out_size) {
-			if((*data=(uint8 *)malloc(*out_size*sizeof(uint8))) == NULL)
+			if((*data=(uint8 *)talloc_zero(p->mem_ctx, *out_size*sizeof(uint8))) == NULL)
 				return ERROR_NOT_ENOUGH_MEMORY;
-			memset(*data, '\0', *out_size*sizeof(uint8));
 		} else {
 			*data = NULL;
 		}
@@ -2070,7 +2069,9 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int
 	SPOOL_NOTIFY_INFO_DATA *current_data;
 	NT_PRINTER_INFO_LEVEL *printer = NULL;
 	print_queue_struct *queue=NULL;
-	
+	size_t realloc_size = 0;
+	SPOOL_NOTIFY_INFO_DATA *info_data_ptr = NULL;
+
 	type=option_type->type;
 
 	DEBUG(4,("construct_notify_printer_info: Notify type: [%s], number of notify info: [%d] on printer: [%s]\n",
@@ -2087,10 +2088,11 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int
 		if (!search_notify(type, field, &j) )
 			continue;
 		
-		if((info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
+		realloc_size = (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA);
+		if((info_data_ptr=(SPOOL_NOTIFY_INFO_DATA *)Realloc(info_data_ptr, realloc_size)) == NULL) {
 			return False;
 		}
-		current_data=&info->data[info->count];
+		current_data=&info_data_ptr[info->count];
 
 		construct_info_data(current_data, type, field, id);		
 
@@ -2103,6 +2105,12 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int
 		info->count++;
 	}
 
+	if (realloc_size)
+		info->data = talloc_memdup(mem_ctx, info_data_ptr, realloc_size);
+	else
+		info->data = NULL;
+
+	safe_free(info_data_ptr);
 	free_a_printer(&printer, 2);
 	return True;
 }
@@ -2322,9 +2330,8 @@ static uint32 printer_notify_info(POLICY_HND *hnd, SPOOL_NOTIFY_INFO *info,
 /********************************************************************
  * spoolss_rfnpcnex
  ********************************************************************/
-uint32 _spoolss_rfnpcnex( POLICY_HND *handle, uint32 change,
+uint32 _spoolss_rfnpcnex( pipes_struct *p, POLICY_HND *handle, uint32 change,
-			  SPOOL_NOTIFY_OPTION *option, TALLOC_CTX *mem_ctx,
+			  SPOOL_NOTIFY_OPTION *option, SPOOL_NOTIFY_INFO *info)
-			  SPOOL_NOTIFY_INFO *info)
 {
 	Printer_entry *Printer=find_printer_index_by_hnd(handle);
 	uint32 result = ERROR_INVALID_HANDLE;
@@ -2348,18 +2355,16 @@ uint32 _spoolss_rfnpcnex( POLICY_HND *handle, uint32 change,
 	 *	informations even when _NOTHING_ has changed.
 	 */
 
-	/* just discard the SPOOL_NOTIFY_OPTION */
+	/* just ignore the SPOOL_NOTIFY_OPTION */
-	if (option!=NULL)
-		safe_free(option->ctr.type);
 	
 	switch (Printer->printer_type) {
 		case PRINTER_HANDLE_IS_PRINTSERVER:
 			result = printserver_notify_info(handle, info, 
-							 mem_ctx);
+							 p->mem_ctx);
 			break;
 			
 		case PRINTER_HANDLE_IS_PRINTER:
-			result = printer_notify_info(handle, info, mem_ctx);
+			result = printer_notify_info(handle, info, p->mem_ctx);
 			break;
 	}
 	
@@ -2910,7 +2915,6 @@ static BOOL enum_all_printers_info_2(NEW_BUFFER *buffer, uint32 offered, uint32
 	if (!alloc_buffer_size(buffer, *needed)) {
 		for (i=0; i<*returned; i++) {
 			free_devmode(printers[i].devmode);
-			free_sec_desc(&printers[i].secdesc);
 		}
 		safe_free(printers);
 		return ERROR_INSUFFICIENT_BUFFER;
@@ -2923,7 +2927,6 @@ static BOOL enum_all_printers_info_2(NEW_BUFFER *buffer, uint32 offered, uint32
 	/* clear memory */
 	for (i=0; i<*returned; i++) {
 		free_devmode(printers[i].devmode);
-		free_sec_desc(&printers[i].secdesc);
 	}
 	safe_free(printers);
 
@@ -3930,7 +3933,7 @@ static uint32 update_printer_sec(POLICY_HND *handle, uint32 level,
 	   dialog boxes when the user doesn't have permission to change
 	   the security descriptor. */
 
-	nt_printing_getsec(Printer->dev.handlename, &old_secdesc_ctr);
+	nt_printing_getsec(p->mem_ctx, Printer->dev.handlename, &old_secdesc_ctr);
 
 	if (DEBUGLEVEL >= 10) {
 		SEC_ACL *acl;
@@ -3968,7 +3971,7 @@ static uint32 update_printer_sec(POLICY_HND *handle, uint32 level,
 		}
 	}
 
-	new_secdesc_ctr = sec_desc_merge(secdesc_ctr, old_secdesc_ctr);
+	new_secdesc_ctr = sec_desc_merge(p->mem_ctx, secdesc_ctr, old_secdesc_ctr);
 
 	if (sec_desc_equal(new_secdesc_ctr->sec, old_secdesc_ctr->sec)) {
 		result = NT_STATUS_NO_PROBLEMO;
@@ -3992,8 +3995,6 @@ static uint32 update_printer_sec(POLICY_HND *handle, uint32 level,
 	result = nt_printing_setsec(Printer->dev.handlename, new_secdesc_ctr);
 
  done:
-	free_sec_desc_buf(&new_secdesc_ctr);
-	free_sec_desc_buf(&old_secdesc_ctr);
 
 	return result;
 }
@@ -5626,7 +5627,7 @@ uint32 _spoolss_getprinterdriverdirectory(UNISTR2 *name, UNISTR2 *uni_environmen
 	
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_enumprinterdata(POLICY_HND *handle, uint32 idx,
+uint32 _spoolss_enumprinterdata(pipes_struct *p, POLICY_HND *handle, uint32 idx,
 				uint32 in_value_len, uint32 in_data_len,
 				uint32 *out_max_value_len, uint16 **out_value, uint32 *out_value_len,
 				uint32 *out_type,
@@ -5758,24 +5759,22 @@ uint32 _spoolss_enumprinterdata(POLICY_HND *handle, uint32 idx,
 	 */
 	
 	*out_max_value_len=(in_value_len/sizeof(uint16));
-	if((*out_value=(uint16 *)malloc(in_value_len*sizeof(uint8))) == NULL) {
+	if((*out_value=(uint16 *)talloc_zero(p->mem_ctx,in_value_len*sizeof(uint8))) == NULL) {
 		safe_free(data);
 		return ERROR_NOT_ENOUGH_MEMORY;
 	}
 	
-	ZERO_STRUCTP(*out_value);
 	*out_value_len = (uint32)dos_PutUniCode((char *)*out_value, value, in_value_len, True);
 
 	*out_type=type;
 
 	/* the data is counted in bytes */
 	*out_max_data_len=in_data_len;
-	if((*data_out=(uint8 *)malloc(in_data_len*sizeof(uint8))) == NULL) {
+	if((*data_out=(uint8 *)talloc_zero(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL) {
 		safe_free(data);
 		return ERROR_NOT_ENOUGH_MEMORY;
 	}
 	
-	memset(*data_out,'\0',in_data_len);
 	memcpy(*data_out, data, (size_t)data_len);
 	*out_data_len=data_len;
 

source/smbd/nttrans.c

@@ -1099,7 +1099,6 @@ static BOOL set_sd(files_struct *fsp, char *data, uint32 sd_len, uint security_i
 	 */
 
 	if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
-		free_sec_desc(&psd);
 		DEBUG(0,("set_sd: Error in unmarshalling security descriptor.\n"));
 		/*
 		 * Return access denied for want of a better error message..
@@ -1122,14 +1121,12 @@ static BOOL set_sd(files_struct *fsp, char *data, uint32 sd_len, uint security_i
 	ret = set_nt_acl( fsp, security_info_sent, psd);
 
 	if (!ret) {
-		free_sec_desc(&psd);
 		talloc_destroy(mem_ctx);
 		*pdef_class = ERRDOS;
 		*pdef_code = ERRnoaccess;
 		return False;
 	}
 
-	free_sec_desc(&psd);
 	talloc_destroy(mem_ctx);
 
 	*pdef_class = 0;
@@ -1638,8 +1635,6 @@ static int call_nt_transact_query_security_desc(connection_struct *conn,
 
   if(max_data_count < sd_size) {
 
-    free_sec_desc(&psd);
-
     send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_BUFFER_TOO_SMALL,
                     params, 4, *ppdata, 0);
     return -1;
@@ -1651,7 +1646,6 @@ static int call_nt_transact_query_security_desc(connection_struct *conn,
 
   data = Realloc(*ppdata, sd_size);
   if(data == NULL) {
-    free_sec_desc(&psd);
     return(ERROR(ERRDOS,ERRnomem));
   }
 
@@ -1665,7 +1659,6 @@ static int call_nt_transact_query_security_desc(connection_struct *conn,
 
   if ((mem_ctx = talloc_init()) == NULL) {
     DEBUG(0,("call_nt_transact_query_security_desc: talloc_init failed.\n"));
-    free_sec_desc(&psd);
     return(ERROR(ERRDOS,ERRnomem));
   }
 
@@ -1683,7 +1676,6 @@ static int call_nt_transact_query_security_desc(connection_struct *conn,
    */
 
   if(!sec_io_desc( "sd data", &psd, &pd, 1)) {
-    free_sec_desc(&psd);
     DEBUG(0,("call_nt_transact_query_security_desc: Error in marshalling \
 security descriptor.\n"));
     /*
@@ -1697,7 +1689,6 @@ security descriptor.\n"));
    * Now we can delete the security descriptor.
    */
 
-  free_sec_desc(&psd);
   talloc_destroy(mem_ctx);
 
   send_nt_replies(inbuf, outbuf, bufsize, 0, params, 4, data, (int)sd_size);

source/smbd/posix_acls.c

@@ -41,6 +41,7 @@ typedef struct canon_ace {
 
 static void free_canon_ace_list( canon_ace *list_head );
 
+#if !defined(HAVE_NO_ACLS)
 /****************************************************************************
  Function to duplicate a canon_ace entry.
 ****************************************************************************/
@@ -56,6 +57,7 @@ static canon_ace *dup_canon_ace( canon_ace *src_ace)
 	dst_ace->prev = dst_ace->next = NULL;
 	return dst_ace;
 }
+#endif /* HAVE_NO_ACLS */
 
 /****************************************************************************
  Function to create owner and group SIDs from a SMB_STRUCT_STAT.
@@ -243,6 +245,7 @@ static BOOL unpack_nt_owners(SMB_STRUCT_STAT *psbuf, uid_t *puser, gid_t *pgrp,
 	return True;
 }
 
+#if !defined(HAVE_NO_ACLS)
 /****************************************************************************
  Merge aces with a common user.
 ****************************************************************************/
@@ -378,6 +381,7 @@ static BOOL ensure_canon_entry_valid(canon_ace **pp_ace,
 
 	return True;
 }
+#endif /* HAVE_NO_ACLS */
 
 /****************************************************************************
  Unpack a SEC_DESC into two canonical ace lists. We don't depend on this
@@ -577,7 +581,6 @@ static BOOL unpack_canon_ace(files_struct *fsp,
 		 */
 
 		DEBUG(10,("unpack_canon_ace: Win2k inherit acl traverse. Ignoring DACL.\n"));
-		free_sec_acl(&psd->dacl);
 	}
 
 	/*
@@ -788,7 +791,6 @@ static BOOL unpack_posix_permissions(files_struct *fsp, SMB_STRUCT_STAT *psbuf,
      */
 
     DEBUG(10,("unpack_posix_permissions: Win2k inherit acl traverse. Ignoring DACL.\n"));
-    free_sec_acl(&psd->dacl);
   }
 
   /*
@@ -1403,13 +1405,13 @@ size_t get_nt_acl(files_struct *fsp, SEC_DESC **ppdesc)
 	}
 
 	if (num_acls) {
-		if((psa = make_sec_acl( ACL_REVISION, num_aces, nt_ace_list)) == NULL) {
+		if((psa = make_sec_acl( main_loop_talloc_get(), ACL_REVISION, num_aces, nt_ace_list)) == NULL) {
 			DEBUG(0,("get_nt_acl: Unable to malloc space for acl.\n"));
 			goto done;
 		}
 	}
 
-	*ppdesc = make_standard_sec_desc( &owner_sid, &group_sid, psa, &sd_size);
+	*ppdesc = make_standard_sec_desc( main_loop_talloc_get(), &owner_sid, &group_sid, psa, &sd_size);
 
 	if(!*ppdesc) {
 		DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n"));
@@ -1426,8 +1428,6 @@ size_t get_nt_acl(files_struct *fsp, SEC_DESC **ppdesc)
 	free_canon_ace_list(dir_ace);
 	if (nt_ace_list)
 		free(nt_ace_list);
-	if (psa)
-		free_sec_acl(&psa);
 
 	return sd_size;
 }
@@ -1700,5 +1700,4 @@ int fchmod_acl(int fd, mode_t mode)
 	sys_acl_free_acl(posix_acl);
 	return ret;
 }
-
 #undef OLD_NTDOMAIN