diff options
author | David Disseldorp <ddiss@samba.org> | 2014-12-17 16:54:42 +0100 |
---|---|---|
committer | Karolin Seeger <kseeger@samba.org> | 2015-01-15 13:55:09 +0100 |
commit | a756e6551c87f3457fbac77a651075dab58c503a (patch) | |
tree | 93ab37bc25b571aca904cefa55ac1c88c2b2025b | |
parent | 4e3e5e7c91844246b92819bbb777a2657ed3d0f9 (diff) | |
download | samba-a756e6551c87f3457fbac77a651075dab58c503a.tar.gz |
spoolss: clear PrinterInfo on GetPrinter error
If an error is returned without zeroing a pre-allocated @info pointer,
then marshalling of the response will fail.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10984
Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit a11e97b79645ff0d9e7d20f5318a979194a858fe)
-rw-r--r-- | source3/rpc_server/spoolss/srv_spoolss_nt.c | 19 |
1 files changed, 12 insertions, 7 deletions
diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c index c34b04de898..115af2d6869 100644 --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c @@ -4778,17 +4778,20 @@ WERROR _spoolss_GetPrinter(struct pipes_struct *p, /* that's an [in out] buffer */ if (!r->in.buffer && (r->in.offered != 0)) { - return WERR_INVALID_PARAM; + result = WERR_INVALID_PARAM; + goto err_info_free; } *r->out.needed = 0; if (Printer == NULL) { - return WERR_BADFID; + result = WERR_BADFID; + goto err_info_free; } if (!get_printer_snum(p, r->in.handle, &snum, NULL)) { - return WERR_BADFID; + result = WERR_BADFID; + goto err_info_free; } result = winreg_get_printer_internal(p->mem_ctx, @@ -4797,7 +4800,7 @@ WERROR _spoolss_GetPrinter(struct pipes_struct *p, lp_const_servicename(snum), &info2); if (!W_ERROR_IS_OK(result)) { - goto out; + goto err_info_free; } switch (r->in.level) { @@ -4857,12 +4860,10 @@ WERROR _spoolss_GetPrinter(struct pipes_struct *p, } TALLOC_FREE(info2); - out: if (!W_ERROR_IS_OK(result)) { DEBUG(0, ("_spoolss_GetPrinter: failed to construct printer info level %d - %s\n", r->in.level, win_errstr(result))); - TALLOC_FREE(r->out.info); - return result; + goto err_info_free; } *r->out.needed = SPOOLSS_BUFFER_UNION(spoolss_PrinterInfo, @@ -4870,6 +4871,10 @@ WERROR _spoolss_GetPrinter(struct pipes_struct *p, r->out.info = SPOOLSS_BUFFER_OK(r->out.info, NULL); return SPOOLSS_BUFFER_OK(WERR_OK, WERR_INSUFFICIENT_BUFFER); + +err_info_free: + TALLOC_FREE(r->out.info); + return result; } /******************************************************************** |