sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code

spoolss: clear PrinterInfo on GetPrinter error

Browse Source 
If an error is returned without zeroing a pre-allocated @info pointer,
then marshalling of the response will fail.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10984

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
This commit is contained in:
David Disseldorp 2014-12-17 16:54:42 +01:00 committed by Andreas Schneider
parent c9fccb5018
commit a11e97b796
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
source3/rpc_server/spoolss/srv_spoolss_nt.c
View File

@ -4778,17 +4778,20 @@ WERROR _spoolss_GetPrinter(struct pipes_struct *p,
/* that's an [in out] buffer */
if (!r->in.buffer && (r->in.offered != 0)) {
return WERR_INVALID_PARAM;
result = WERR_INVALID_PARAM;
goto err_info_free;
}
*r->out.needed = 0;
if (Printer == NULL) {
return WERR_BADFID;
result = WERR_BADFID;
goto err_info_free;
}
if (!get_printer_snum(p, r->in.handle, &snum, NULL)) {
return WERR_BADFID;
result = WERR_BADFID;
goto err_info_free;
}
result = winreg_get_printer_internal(p->mem_ctx,
@ -4797,7 +4800,7 @@ WERROR _spoolss_GetPrinter(struct pipes_struct *p,
lp_const_servicename(snum),
&info2);
if (!W_ERROR_IS_OK(result)) {
goto out;
goto err_info_free;
}
switch (r->in.level) {
@ -4857,12 +4860,10 @@ WERROR _spoolss_GetPrinter(struct pipes_struct *p,
}
TALLOC_FREE(info2);
out:
if (!W_ERROR_IS_OK(result)) {
DEBUG(0, ("_spoolss_GetPrinter: failed to construct printer info level %d - %s\n",
r->in.level, win_errstr(result)));
TALLOC_FREE(r->out.info);
return result;
goto err_info_free;
}
*r->out.needed = SPOOLSS_BUFFER_UNION(spoolss_PrinterInfo,
@ -4870,6 +4871,10 @@ WERROR _spoolss_GetPrinter(struct pipes_struct *p,
r->out.info = SPOOLSS_BUFFER_OK(r->out.info, NULL);
return SPOOLSS_BUFFER_OK(WERR_OK, WERR_INSUFFICIENT_BUFFER);
err_info_free:
TALLOC_FREE(r->out.info);
return result;
}
/********************************************************************