- The printers are indexed by the sharename in both get_a_printer() and

add_a_printer() now.

- correctly unpack the private part of a devmode and remove a memleak

- correctly retrieve the pair(value,data) for getprinterdata

- handle null devicemode in printer_info_2

I still have some bugs but I'm not crashing anymore NT4SP6 d/c build :-)


        J.F.

source/printing/nt_printing.c

@@ -677,7 +677,7 @@ static uint32 add_a_printer_2(NT_PRINTER_INFO_LEVEL_2 *info)
 	
 
 	slprintf(key, sizeof(key), "%s%s",
-		 PRINTERS_PREFIX, info->portname);
+		 PRINTERS_PREFIX, info->sharename);
 
 	kbuf.dptr = key;
 	kbuf.dsize = strlen(key)+1;
@@ -686,10 +686,13 @@ static uint32 add_a_printer_2(NT_PRINTER_INFO_LEVEL_2 *info)
 
 	ret = tdb_store(tdb, kbuf, dbuf, TDB_REPLACE);
 
+	if (ret == -1)
+		DEBUG(8, ("error updating printer to tdb on disk\n"));
+
 	safe_free(buf);
 
-	DEBUG(8,("packed printer [%s] with printprocessor [%s] parameters=[%s] len=%d\n", 
+	DEBUG(8,("packed printer [%s] with driver [%s] portname=[%s] len=%d\n", 
-		 info->portname, info->printprocessor, info->parameters, len));
+		 info->portname, info->drivername, info->portname, len));
 
 	return ret;
 }
@@ -974,17 +977,14 @@ static int unpack_devicemode(NT_DEVICEMODE **nt_devmode, char *buf, int buflen)
 			  &devmode.panningheight,
 			  &devmode.private);
 	
-	if (devmode.private) {
+	if (devmode.private)		
-		devmode.private = (uint8 *)malloc(devmode.driverextra);
+		len += tdb_unpack(buf+len, buflen-len, "B", &devmode.driverextra, &devmode.private);
-		if (!devmode.private) return 2;
-		len += tdb_unpack(buf+len, buflen-len, "B",
-				  devmode.driverextra,
-				  devmode.private);
-	}
 
 	*nt_devmode = (NT_DEVICEMODE *)memdup(&devmode, sizeof(devmode));
 
-	DEBUG(8,("Unpacked devicemode [%s]\n", devmode.formname));
+	DEBUG(8,("Unpacked devicemode [%s](%s)\n", devmode.devicename, devmode.formname));
+	if (devmode.private)
+		DEBUG(8,("with a private section of %d bytes\n", devmode.driverextra));
 
 	return len;
 }
@@ -1128,8 +1128,8 @@ static uint32 get_a_printer_2(NT_PRINTER_INFO_LEVEL_2 **info_ptr, fstring sharen
 	safe_free(dbuf.dptr);
 	*info_ptr=memdup(&info, sizeof(info));
 
-	DEBUG(9,("Unpacked printprocessor for [%s] of [%s]\n",
+	DEBUG(9,("Unpacked printer [%s] running drier [%s]\n",
-		 sharename, info.printprocessor));
+		 sharename, info.drivername));
 
 	
 	return 0;	
@@ -1414,8 +1414,7 @@ BOOL get_specific_param_by_index(NT_PRINTER_INFO_LEVEL printer, uint32 level, ui
 	
 	param=printer.info_2->specific;
 	
-	while (param != NULL && i <= param_index)
+	while (param != NULL && i < param_index) {
-	{
 		param=param->next;
 		i++;
 	}
@@ -1429,6 +1428,7 @@ BOOL get_specific_param_by_index(NT_PRINTER_INFO_LEVEL printer, uint32 level, ui
 	*data=(uint8 *)malloc(param->data_len*sizeof(uint8));
 	if(*data == NULL)
 		return False;
+	ZERO_STRUCTP(*data);
 	memcpy(*data, param->data, param->data_len);
 	*len=param->data_len;
 	return True;

source/rpc_parse/parse_spoolss.c

@@ -1575,6 +1575,15 @@ static BOOL new_smb_io_reldevmode(char *desc, NEW_BUFFER *buffer, int depth, DEV
 		uint32 struct_offset = prs_offset(ps);
 		uint32 relative_offset;
 		
+		if (*devmode == NULL) {
+			relative_offset=0;
+			if (!prs_uint32("offset", ps, depth, &relative_offset))
+				return False;
+			DEBUG(8, ("boing, the devmode was NULL\n"));
+			
+			return True;
+		}
+		
 		buffer->string_at_end -= ((*devmode)->size + (*devmode)->driverextra);
 		
 		if(!prs_set_offset(ps, buffer->string_at_end))

source/rpc_server/srv_spoolss_nt.c

@@ -1796,9 +1796,10 @@ static DEVICEMODE *construct_dev_mode(int snum, char *servername)
 
 	if (printer->info_2->devmode)
 		ntdevmode = dup_nt_devicemode(printer->info_2->devmode);
+#if 0 /* JFMTEST */
 	else
 		ntdevmode = construct_nt_devicemode(printer->info_2->printername);
-
+#endif
 	if (ntdevmode == NULL)
 		goto fail;
 
@@ -1914,8 +1915,12 @@ static BOOL construct_printer_info_2(fstring servername, PRINTER_INFO_2 *printer
 	printer->cjobs = count;							/* jobs */
 	printer->averageppm = ntprinter->info_2->averageppm;			/* average pages per minute */
 			
-	if((printer->devmode = construct_dev_mode(snum, servername)) == NULL)
+	if((printer->devmode = construct_dev_mode(snum, servername)) == NULL) {
+		DEBUG(8, ("Returning NULL Devicemode!\n"));
+#if 0 /* JFMTEST */
 		goto err;
+#endif
+	}
 
 	if (ntprinter->info_2->secdesc_buf && ntprinter->info_2->secdesc_buf->len != 0) {
 		/* steal the printer info sec_desc structure.  [badly done]. */
@@ -3046,6 +3051,7 @@ static uint32 update_printer(const POLICY_HND *handle, uint32 level,
 
 	/* Check calling user has permission to update printer description */ 
 
+#if 1 /* JFMTEST */
 	if (!nt_printing_getsec(Printer->dev.printername, &sd)) {
 		DEBUG(3, ("Could not get security descriptor for printer %s",
 			  Printer->dev.printername));
@@ -3061,7 +3067,7 @@ static uint32 update_printer(const POLICY_HND *handle, uint32 level,
 			  "descriptor\n"));
 		goto done;
 	}
-
+#endif
 	if (level!=2) {
 		DEBUG(0,("Send a mail to samba@samba.org\n"));
 		DEBUGADD(0,("with the following message: update_printer: level!=2\n"));
@@ -3596,9 +3602,9 @@ static uint32 enumprinterdrivers_level3(fstring *list, fstring servername, fstri
 		return ERROR_INSUFFICIENT_BUFFER;
 	}
 	
-	/* fill the buffer with the form structures */
+	/* fill the buffer with the driver structures */
 	for (i=0; i<*returned; i++) {
-		DEBUGADD(6,("adding form [%d] to buffer\n",i));
+		DEBUGADD(6,("adding driver [%d] to buffer\n",i));
 		new_smb_io_printer_driver_info_3("", buffer, &driver_info_3[i], 0);
 	}
 
@@ -3653,6 +3659,7 @@ uint32 _spoolss_enumprinterdrivers( UNISTR2 *name, UNISTR2 *environment, uint32
 		return enumprinterdrivers_level3(list, servername, architecture, buffer, offered, needed, returned);
 		break;
 	default:
+		*returned=0;
 		return ERROR_INVALID_LEVEL;
 		break;
 	}
@@ -4264,6 +4271,8 @@ uint32 _spoolss_enumprinterdata(const POLICY_HND *handle, uint32 idx,
 		safe_free(data);
 		return ERROR_NOT_ENOUGH_MEMORY;
 	}
+	
+	ZERO_STRUCTP(*out_value);
 	*out_value_len = (uint32)dos_PutUniCode((char *)*out_value, value, in_value_len, True);
 
 	*out_type=type;
@@ -4274,6 +4283,8 @@ uint32 _spoolss_enumprinterdata(const POLICY_HND *handle, uint32 idx,
 		safe_free(data);
 		return ERROR_NOT_ENOUGH_MEMORY;
 	}
+	
+	ZERO_STRUCTP(*data_out);
 	memcpy(*data_out, data, (size_t)data_len);
 	*out_data_len=data_len;