sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-24 02:04:21 +03:00
Code

don't leak printer handles,

Browse Source 
don't coredump when adding forms,
and a small non obvious memory leak in the rpc buffers

	J.F.
(This used to be commit bee11f8889378b9f1cc6e2818fd0f8dd7ddcf10d)
This commit is contained in:
Jean-François Micouleau 1999-09-27 13:12:55 +00:00
parent 0490365b04
commit ed5fbd743b
4 changed files with 23 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
source3/include/proto.h
View File

@ -1636,7 +1636,7 @@ struct passgrp_ops *unix_initialise_password_grp(void);
int get_ntforms(nt_forms_struct **list);
int write_ntforms(nt_forms_struct **list, int number);
void add_a_form(nt_forms_struct **list, FORM form, int count);
void add_a_form(nt_forms_struct **list, FORM form, int *count);
void update_a_form(nt_forms_struct **list, FORM form, int count);
int get_ntdrivers(connection_struct *conn, fstring **list, char *architecture);
void get_short_archi(char *short_archi, char *long_archi);

6
source3/printing/nt_printing.c
View File

@ -126,7 +126,7 @@ int write_ntforms(nt_forms_struct **list, int number)
/****************************************************************************
add a form struct at the end of the list
****************************************************************************/
void add_a_form(nt_forms_struct **list, FORM form, int count)
void add_a_form(nt_forms_struct **list, FORM form, int *count)
{
int n=0;
BOOL update;
@ -141,7 +141,7 @@ void add_a_form(nt_forms_struct **list, FORM form, int count)
update=False;
unistr2_to_ascii(form_name, &(form.name), sizeof(form_name)-1);
for (n=0; n<count && update==False; n++)
for (n=0; n<*count && update==False; n++)
{
if (!strncmp((*list)[n].name, form_name, strlen(form_name)))
{
@ -154,6 +154,7 @@ void add_a_form(nt_forms_struct **list, FORM form, int count)
{
*list=Realloc(*list, (n+1)*sizeof(nt_forms_struct));
unistr2_to_ascii((*list)[n].name, &(form.name), sizeof((*list)[n].name)-1);
(*count)++;
}
(*list)[n].flag=form.flags;
@ -163,7 +164,6 @@ void add_a_form(nt_forms_struct **list, FORM form, int count)
(*list)[n].top=form.top;
(*list)[n].right=form.right;
(*list)[n].bottom=form.bottom;
}
/****************************************************************************

17
source3/rpc_server/srv_spoolss.c
View File

@ -407,7 +407,19 @@ static void spoolss_reply_open_printer(SPOOL_Q_OPEN_PRINTER *q_u, prs_struct *rd
}
set_printer_hnd_accesstype(&(r_u.handle), q_u->access_required);
/* if there is a error free the printer entry */
if (r_u.status != 0x00000000)
{
int pnum;
pnum = find_printer_index_by_hnd(&(r_u.handle));
Printer[pnum].open=False;
clear_handle(&(r_u.handle));
}
spoolss_io_r_open_printer("",&r_u,rdata,0);
}
@ -669,7 +681,6 @@ static void spoolss_reply_closeprinter(SPOOL_Q_CLOSEPRINTER *q_u, prs_struct *rd
{
Printer[pnum].open=False;
r_u.status=0x0;
spoolss_io_r_closeprinter("",&r_u,rdata,0);
}
else
{
@ -3551,9 +3562,9 @@ static void spoolss_reply_addform(SPOOL_Q_ADDFORM *q_u, prs_struct *rdata)
{
count=get_ntforms(&list);
add_a_form(&list, q_u->form, count);
add_a_form(&list, q_u->form, &count);
write_ntforms(&list, count+1);
write_ntforms(&list, count);
free(list);
}

7
source3/smbd/ipc.c
View File

@ -3128,7 +3128,10 @@ static void api_rpc_trans_reply(char *outbuf,
/* all of data was sent: no need to wait for SMBreadX calls */
mem_free_data(p->rhdr .data);
mem_free_data(p->rdata.data);
mem_free_data(p->rdata_i.data);
mem_free_data(p->rdata_i.data);
mem_free_data(p->rauth.data);
mem_free_data(p->rverf.data);
mem_free_data(p->rntlm.data);
}
}
@ -3281,7 +3284,7 @@ static int api_fd_reply(connection_struct *conn,uint16 vuid,char *outbuf,
}
mem_free_data(pd.data);
if (!reply)
{
return api_no_reply(outbuf, mdrcnt);