spoolss: make spoolss deal with ndr64 AddForm by using proper container object.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

6 files changed, 46 insertions, 31 deletions

diff --git a/librpc/idl/spoolss.idl b/librpc/idl/spoolss.idl
index 44eaee56ff2..8e2564b758a 100644
--- a/librpc/idl/spoolss.idl
+++ b/librpc/idl/spoolss.idl
@@ -2038,10 +2038,14 @@ cpp_quote("#define spoolss_security_descriptor security_descriptor")
 		[case(2)] spoolss_AddFormInfo2 *info2;
 	} spoolss_AddFormInfo;
 
+	typedef struct {
+		uint32 level;
+		[switch_is(level)] spoolss_AddFormInfo info;
+	} spoolss_AddFormInfoCtr;
+
 	WERROR spoolss_AddForm(
 		[in,ref] policy_handle *handle,
-		[in] uint32 level,
-		[in,switch_is(level)] spoolss_AddFormInfo info
+		[in,ref] spoolss_AddFormInfoCtr *info_ctr
 	);
 
 	/******************/
diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c
index 48a2981986c..b4f1bec15e0 100644
--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
@@ -8648,7 +8648,7 @@ WERROR _spoolss_DeletePrinterData(struct pipes_struct *p,
 WERROR _spoolss_AddForm(struct pipes_struct *p,
 			struct spoolss_AddForm *r)
 {
-	struct spoolss_AddFormInfo1 *form = r->in.info.info1;
+	struct spoolss_AddFormInfo1 *form;
 	int snum = -1;
 	WERROR status = WERR_OK;
 	struct printer_handle *Printer = find_printer_index_by_hnd(p, r->in.handle);
@@ -8673,6 +8673,15 @@ WERROR _spoolss_AddForm(struct pipes_struct *p,
 		return WERR_ACCESS_DENIED;
 	}
 
+	if (r->in.info_ctr->level != 1) {
+		return WERR_INVALID_LEVEL;
+	}
+
+	form = r->in.info_ctr->info.info1;
+	if (!form) {
+		return WERR_INVALID_PARAM;
+	}
+
 	switch (form->flags) {
 	case SPOOLSS_FORM_USER:
 	case SPOOLSS_FORM_BUILTIN:
diff --git a/source3/rpcclient/cmd_spoolss.c b/source3/rpcclient/cmd_spoolss.c
index 969b747f4cf..4e5da2a3aef 100644
--- a/source3/rpcclient/cmd_spoolss.c
+++ b/source3/rpcclient/cmd_spoolss.c
@@ -2104,7 +2104,7 @@ static WERROR cmd_spoolss_addform(struct rpc_pipe_client *cli, TALLOC_CTX *mem_c
 	WERROR werror;
 	NTSTATUS status;
 	const char *printername;
-	union spoolss_AddFormInfo info;
+	struct spoolss_AddFormInfoCtr info_ctr;
 	struct spoolss_AddFormInfo1 info1;
 	struct spoolss_AddFormInfo2 info2;
 	uint32_t level = 1;
@@ -2145,7 +2145,8 @@ static WERROR cmd_spoolss_addform(struct rpc_pipe_client *cli, TALLOC_CTX *mem_c
 		info1.area.right	= 20;
 		info1.area.bottom	= 30;
 
-		info.info1 = &info1;
+		info_ctr.level		= 1;
+		info_ctr.info.info1	= &info1;
 
 		break;
 	case 2:
@@ -2164,7 +2165,8 @@ static WERROR cmd_spoolss_addform(struct rpc_pipe_client *cli, TALLOC_CTX *mem_c
 		info2.display_name	= argv[2];
 		info2.lang_id		= 0;
 
-		info.info2 = &info2;
+		info_ctr.level		= 2;
+		info_ctr.info.info2	= &info2;
 
 		break;
 	default:
@@ -2174,11 +2176,9 @@ static WERROR cmd_spoolss_addform(struct rpc_pipe_client *cli, TALLOC_CTX *mem_c
 
 	/* Add the form */
 
-
 	status = dcerpc_spoolss_AddForm(b, mem_ctx,
 					&handle,
-					level,
-					info,
+					&info_ctr,
 					&werror);
 	if (!NT_STATUS_IS_OK(status)) {
 		werror = ntstatus_to_werror(status);
diff --git a/source3/utils/net_rpc_printer.c b/source3/utils/net_rpc_printer.c
index 4fbe14f294c..9743d08e0c1 100644
--- a/source3/utils/net_rpc_printer.c
+++ b/source3/utils/net_rpc_printer.c
@@ -1789,7 +1789,7 @@ NTSTATUS rpc_printer_migrate_forms_internals(struct net_context *c,
 
 		for (f = 0; f < num_forms; f++) {
 
-			union spoolss_AddFormInfo info;
+			struct spoolss_AddFormInfoCtr info_ctr;
 			NTSTATUS status;
 
 			/* only migrate FORM_PRINTER types, according to jerry
@@ -1802,16 +1802,15 @@ NTSTATUS rpc_printer_migrate_forms_internals(struct net_context *c,
 					   "[%d]\n"),
 					f, forms[f].info1.form_name,
 					forms[f].info1.flags);
-
-			info.info1 = (struct spoolss_AddFormInfo1 *)
+			info_ctr.level = 1;
+			info_ctr.info.info1 = (struct spoolss_AddFormInfo1 *)
 				(void *)&forms[f].info1;
 
 			/* FIXME: there might be something wrong with samba's
 			   builtin-forms */
 			status = dcerpc_spoolss_AddForm(b_dst, mem_ctx,
 							&hnd_dst,
-							1,
-							info,
+							&info_ctr,
 							&result);
 			if (!NT_STATUS_IS_OK(status)) {
 				d_printf(_("\tdcerpc_spoolss_AddForm form %d: [%s] - %s\n"),
diff --git a/source4/ntptr/simple_ldb/ntptr_simple_ldb.c b/source4/ntptr/simple_ldb/ntptr_simple_ldb.c
index 04e38068531..d8bb754bd7a 100644
--- a/source4/ntptr/simple_ldb/ntptr_simple_ldb.c
+++ b/source4/ntptr/simple_ldb/ntptr_simple_ldb.c
@@ -319,21 +319,21 @@ static WERROR sptr_AddPrintServerForm(struct ntptr_GenericHandle *server, TALLOC
 	 * }
 	 */
 
-	switch (r->in.level) {
+	switch (r->in.info_ctr->level) {
 	case 1:
-		if (!r->in.info.info1) {
+		if (!r->in.info_ctr->info.info1) {
 			return WERR_FOOBAR;
 		}
 		count = sptr_db_search(sptr_db, mem_ctx,
 				       ldb_dn_new(mem_ctx, sptr_db, "CN=Forms,CN=PrintServer"),
 				       &msgs, attrs, "(&(form-name=%s)(objectClass=form))",
-				       r->in.info.info1->form_name);
+				       r->in.info_ctr->info.info1->form_name);
 
 		if (count == 1) return WERR_FOOBAR;
 		if (count > 1) return WERR_FOOBAR;
 		if (count < 0) return WERR_GENERAL_FAILURE;
 
-		if (r->in.info.info1->flags != SPOOLSS_FORM_USER) {
+		if (r->in.info_ctr->info.info1->flags != SPOOLSS_FORM_USER) {
 			return WERR_FOOBAR;
 		}
 
@@ -341,20 +341,20 @@ static WERROR sptr_AddPrintServerForm(struct ntptr_GenericHandle *server, TALLOC
 		W_ERROR_HAVE_NO_MEMORY(msg);
 
 		/* add core elements to the ldb_message for the Form */
-		msg->dn = ldb_dn_new_fmt(msg, sptr_db, "form-name=%s,CN=Forms,CN=PrintServer", r->in.info.info1->form_name);
+		msg->dn = ldb_dn_new_fmt(msg, sptr_db, "form-name=%s,CN=Forms,CN=PrintServer", r->in.info_ctr->info.info1->form_name);
 		SET_STRING(sptr_db, msg, "objectClass", "form");
 
-		SET_UINT(sptr_db, msg, "flags", r->in.info.info1->flags);
+		SET_UINT(sptr_db, msg, "flags", r->in.info_ctr->info.info1->flags);
 
-		SET_STRING(sptr_db, msg, "form-name", r->in.info.info1->form_name);
+		SET_STRING(sptr_db, msg, "form-name", r->in.info_ctr->info.info1->form_name);
 
-		SET_UINT(sptr_db, msg, "size-width", r->in.info.info1->size.width);
-		SET_UINT(sptr_db, msg, "size-height", r->in.info.info1->size.height);
+		SET_UINT(sptr_db, msg, "size-width", r->in.info_ctr->info.info1->size.width);
+		SET_UINT(sptr_db, msg, "size-height", r->in.info_ctr->info.info1->size.height);
 
-		SET_UINT(sptr_db, msg, "area-left", r->in.info.info1->area.left);
-		SET_UINT(sptr_db, msg, "area-top", r->in.info.info1->area.top);
-		SET_UINT(sptr_db, msg, "area-right", r->in.info.info1->area.right);
-		SET_UINT(sptr_db, msg, "area-bottom", r->in.info.info1->area.bottom);
+		SET_UINT(sptr_db, msg, "area-left", r->in.info_ctr->info.info1->area.left);
+		SET_UINT(sptr_db, msg, "area-top", r->in.info_ctr->info.info1->area.top);
+		SET_UINT(sptr_db, msg, "area-right", r->in.info_ctr->info.info1->area.right);
+		SET_UINT(sptr_db, msg, "area-bottom", r->in.info_ctr->info.info1->area.bottom);
 		break;
 	default:
 		return WERR_UNKNOWN_LEVEL;
diff --git a/source4/torture/rpc/spoolss.c b/source4/torture/rpc/spoolss.c
index 49a0be68e20..25625829f4d 100644
--- a/source4/torture/rpc/spoolss.c
+++ b/source4/torture/rpc/spoolss.c
@@ -2671,18 +2671,21 @@ static bool test_AddForm(struct torture_context *tctx,
 			 WERROR expected_result)
 {
 	struct spoolss_AddForm r;
+	struct spoolss_AddFormInfoCtr info_ctr;
+
+	info_ctr.level = level;
+	info_ctr.info = *info;
 
 	if (level != 1) {
 		torture_skip(tctx, "only level 1 supported");
 	}
 
 	r.in.handle	= handle;
-	r.in.level	= level;
-	r.in.info	= *info;
+	r.in.info_ctr	= &info_ctr;
 
 	torture_comment(tctx, "Testing AddForm(%s) level %d, type %d\n",
-		r.in.info.info1->form_name, r.in.level,
-		r.in.info.info1->flags);
+		r.in.info_ctr->info.info1->form_name, level,
+		r.in.info_ctr->info.info1->flags);
 
 	torture_assert_ntstatus_ok(tctx, dcerpc_spoolss_AddForm_r(b, tctx, &r),
 		"AddForm failed");