Memory leak fix when adding a driver.

Jeremy.

4 files changed, 14 insertions, 12 deletions

diff --git a/source/include/proto.h b/source/include/proto.h
index 2ff347ce198..9d8f7bca926 100644
--- a/source/include/proto.h
+++ b/source/include/proto.h
@@ -1734,8 +1734,9 @@ uint32 clean_up_driver_struct(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract,
 BOOL move_driver_to_download_area(NT_PRINTER_DRIVER_INFO_LEVEL driver_abstract, uint32 level, struct current_user *user, uint32 *perr);
 uint32 get_a_printer_driver_9x_compatible(pstring line, fstring model);
 uint32 del_a_printer(char *sharename);
-BOOL add_a_specific_param(NT_PRINTER_INFO_LEVEL_2 *info_2, NT_PRINTER_PARAM *param);
+void add_a_specific_param(NT_PRINTER_INFO_LEVEL_2 *info_2, NT_PRINTER_PARAM **param);
 BOOL unlink_specific_param_if_exist(NT_PRINTER_INFO_LEVEL_2 *info_2, NT_PRINTER_PARAM *param);
+void free_nt_printer_param(NT_PRINTER_PARAM **param_ptr);
 NT_DEVICEMODE *construct_nt_devicemode(const fstring default_devicename);
 NT_DEVICEMODE *dup_nt_devicemode(NT_DEVICEMODE *nt_devicemode);
 void free_nt_devicemode(NT_DEVICEMODE **devmode_ptr);
diff --git a/source/printing/nt_printing.c b/source/printing/nt_printing.c
index 34d9538752a..bbe01b87f6a 100644
--- a/source/printing/nt_printing.c
+++ b/source/printing/nt_printing.c
@@ -1777,17 +1777,17 @@ static uint32 update_a_printer_2(NT_PRINTER_INFO_LEVEL_2 *info)
 
 /****************************************************************************
 ****************************************************************************/
-BOOL add_a_specific_param(NT_PRINTER_INFO_LEVEL_2 *info_2, NT_PRINTER_PARAM *param)
+void add_a_specific_param(NT_PRINTER_INFO_LEVEL_2 *info_2, NT_PRINTER_PARAM **param)
 {
 	NT_PRINTER_PARAM *current;
 	
 	DEBUG(108,("add_a_specific_param\n"));	
 
-	param->next=NULL;
+	(*param)->next=NULL;
 	
 	if (info_2->specific == NULL)
 	{
-		info_2->specific=param;
+		info_2->specific=*param;
 	}
 	else
 	{
@@ -1795,9 +1795,10 @@ BOOL add_a_specific_param(NT_PRINTER_INFO_LEVEL_2 *info_2, NT_PRINTER_PARAM *par
 		while (current->next != NULL) {
 			current=current->next;
 		}		
-		current->next=param;
+		current->next=*param;
 	}
-	return (True);
+
+	*param = NULL;
 }
 
 /****************************************************************************
@@ -1844,7 +1845,7 @@ BOOL unlink_specific_param_if_exist(NT_PRINTER_INFO_LEVEL_2 *info_2, NT_PRINTER_
 /****************************************************************************
  Clean up and deallocate a (maybe partially) allocated NT_PRINTER_PARAM.
 ****************************************************************************/
-static void free_nt_printer_param(NT_PRINTER_PARAM **param_ptr)
+void free_nt_printer_param(NT_PRINTER_PARAM **param_ptr)
 {
 	NT_PRINTER_PARAM *param = *param_ptr;
 
diff --git a/source/rpc_parse/parse_spoolss.c b/source/rpc_parse/parse_spoolss.c
index c4196b03341..61206d4e703 100644
--- a/source/rpc_parse/parse_spoolss.c
+++ b/source/rpc_parse/parse_spoolss.c
@@ -5338,7 +5338,7 @@ BOOL convert_specific_param(NT_PRINTER_PARAM **param, const UNISTR2 *value,
 		*param=(NT_PRINTER_PARAM *)malloc(sizeof(NT_PRINTER_PARAM));
 		if(*param == NULL)
 			return False;
-		ZERO_STRUCTP(*param);
+		memset((char *)*param, '\0', sizeof(NT_PRINTER_PARAM));
 		DEBUGADD(6,("Allocated a new PARAM struct\n"));
 	}
 	unistr2_to_ascii((*param)->value, value, sizeof((*param)->value)-1);
diff --git a/source/rpc_server/srv_spoolss_nt.c b/source/rpc_server/srv_spoolss_nt.c
index 30acc149049..a04c85368f7 100644
--- a/source/rpc_server/srv_spoolss_nt.c
+++ b/source/rpc_server/srv_spoolss_nt.c
@@ -5198,13 +5198,13 @@ uint32 _spoolss_setprinterdata( POLICY_HND *handle,
 
 	unlink_specific_param_if_exist(printer->info_2, param);
 	
-	if (!add_a_specific_param(printer->info_2, param))
-		status = ERROR_INVALID_PARAMETER;
-	else
-		status = mod_a_printer(*printer, 2);
+	add_a_specific_param(printer->info_2, &param);
+	status = mod_a_printer(*printer, 2);
 
  done:
 	free_a_printer(&printer, 2);
+	if (param)
+		free_nt_printer_param(&param);
 	safe_free(old_param.data);
 
 	return status;