More insure found memory leak and corruption fixes.

Jeremy.

diff --git a/source/include/proto.h b/source/include/proto.h
index e1b444545b9af0a7e359f41ab0f7e7ffde28a711..050de09c6581c45b37cdda901bbfa70e9ae070ed 100644 (file)
--- a/source/include/proto.h
+++ b/source/include/proto.h
@@ -1275,8 +1275,6 @@ char *lp_domain_admin_group(void);
 char *lp_domain_guest_group(void);
 char *lp_domain_admin_users(void);
 char *lp_domain_guest_users(void);
-char *lp_nt_forms(void);
-char *lp_nt_drivers_file(void);
 char *lp_winbind_uid(void);
 char *lp_winbind_gid(void);
 char *lp_template_homedir(void);
@@ -1943,6 +1941,7 @@ void init_buffer3_hex(BUFFER3 *str, char *buf);
 void init_buffer3_bytes(BUFFER3 *str, uint8 *buf, int len);
 BOOL smb_io_buffer3(char *desc, BUFFER3 *buf3, prs_struct *ps, int depth);
 BOOL smb_io_buffer5(char *desc, BUFFER5 *buf5, prs_struct *ps, int depth);
+void free_buffer5(BUFFER5 *buf5);
 void init_buffer2(BUFFER2 *str, uint8 *buf, int len);
 BOOL smb_io_buffer2(char *desc, BUFFER2 *buf2, uint32 buffer, prs_struct *ps, int depth);
 void init_buf_unistr2(UNISTR2 *str, uint32 *ptr, const char *buf);
@@ -2559,11 +2558,15 @@ BOOL spoolss_io_q_addprinterex(char *desc, SPOOL_Q_ADDPRINTEREX *q_u, prs_struct
 BOOL spoolss_io_r_addprinterex(char *desc, SPOOL_R_ADDPRINTEREX *r_u, prs_struct *ps, int depth);
 BOOL spool_io_printer_driver_info_level_3(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u, 
                                           prs_struct *ps, int depth);
+void free_spool_printer_driver_info_level_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u);
 BOOL spool_io_printer_driver_info_level_6(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u, 
                                           prs_struct *ps, int depth);
+void free_spool_printer_driver_info_level_6(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u);
 BOOL smb_io_unibuffer(char *desc, UNISTR2 *buffer, prs_struct *ps, int depth);
 BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LEVEL *il, prs_struct *ps, int depth);
+void free_spool_printer_driver_info_level(SPOOL_PRINTER_DRIVER_INFO_LEVEL *il);
 BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth);
+void free_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u);
 BOOL spoolss_io_r_addprinterdriver(char *desc, SPOOL_R_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth);
 BOOL uni_2_asc_printer_driver_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *uni,
                                 NT_PRINTER_DRIVER_INFO_LEVEL_3 **asc);

diff --git a/source/printing/nt_printing.c b/source/printing/nt_printing.c
index de3b9ed6c5473d1a8e0a7cf64288ea4e8b88d6ca..82facbe453e3d5cb6cef1a33a72a13e57b675b23 100644 (file)
--- a/source/printing/nt_printing.c
+++ b/source/printing/nt_printing.c
@@ -1276,18 +1276,35 @@ uint32 get_a_printer_driver(NT_PRINTER_DRIVER_INFO_LEVEL *driver, uint32 level,
 uint32 free_a_printer_driver(NT_PRINTER_DRIVER_INFO_LEVEL driver, uint32 level)
 {
        uint32 success;
-       NT_PRINTER_DRIVER_INFO_LEVEL_3 *info3;
        
        switch (level)
        {
                case 3: 
                {
+                       NT_PRINTER_DRIVER_INFO_LEVEL_3 *info3;
                        if (driver.info_3 != NULL)
                        {
                                info3=driver.info_3;
                                safe_free(info3->dependentfiles);
-                               safe_free(info3);
                                ZERO_STRUCTP(info3);
+                               safe_free(info3);
+                               success=0;
+                       }
+                       else
+                       {
+                               success=4;
+                       }
+                       break;
+               }
+               case 6: 
+               {
+                       NT_PRINTER_DRIVER_INFO_LEVEL_3 *info6;
+                       if (driver.info_6 != NULL)
+                       {
+                               info6=driver.info_6;
+                               safe_free(info6->dependentfiles);
+                               ZERO_STRUCTP(info6);
+                               safe_free(info6);
                                success=0;
                        }
                        else

diff --git a/source/rpc_parse/parse_misc.c b/source/rpc_parse/parse_misc.c
index da2aa4450e3c1ea37208ca6e22293a37f7bf25f4..fe2778a356ac4900101f62ef1b3e0de57deec511 100644 (file)
--- a/source/rpc_parse/parse_misc.c
+++ b/source/rpc_parse/parse_misc.c
@@ -617,6 +617,15 @@ BOOL smb_io_buffer5(char *desc, BUFFER5 *buf5, prs_struct *ps, int depth)
        return True;
 }
 
+/*******************************************************************
+ Frees a BUFFER5 structure (just the malloced part).
+********************************************************************/
+
+void free_buffer5(BUFFER5 *buf5)
+{
+       safe_free(buf5->buffer);
+}
+
 /*******************************************************************
  Inits a BUFFER2 structure.
 ********************************************************************/

diff --git a/source/rpc_parse/parse_spoolss.c b/source/rpc_parse/parse_spoolss.c
index 2565439a21a217243a139c8979709cf830e9e0d2..5ed7ce24603f4b42ec371646f6dffb6c011a4dce 100644 (file)
--- a/source/rpc_parse/parse_spoolss.c
+++ b/source/rpc_parse/parse_spoolss.c
@@ -3691,11 +3691,22 @@ BOOL spool_io_printer_driver_info_level_3(char *desc, SPOOL_PRINTER_DRIVER_INFO_
                return False;
                
        if (il->dependentfiles_ptr)
-               smb_io_buffer5("", &(il->dependentfiles), ps, depth);
+               smb_io_buffer5("", &il->dependentfiles, ps, depth);
 
        return True;
 }
 
+void free_spool_printer_driver_info_level_3(SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 **q_u)
+{
+       SPOOL_PRINTER_DRIVER_INFO_LEVEL_3 *il = *q_u;
+
+       if (il == NULL)
+               return;
+
+       free_buffer5(&il->dependentfiles);
+
+       safe_free(q_u);
+}
 
 /*******************************************************************
 parse a SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 structure
@@ -3836,6 +3847,19 @@ BOOL spool_io_printer_driver_info_level_6(char *desc, SPOOL_PRINTER_DRIVER_INFO_
        return True;
 }
 
+void free_spool_printer_driver_info_level_6(SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 **q_u)
+{
+       SPOOL_PRINTER_DRIVER_INFO_LEVEL_6 *il = *q_u;
+
+       if (il == NULL)
+               return;
+
+       free_buffer5(&il->dependentfiles);
+       free_buffer5(&il->previousnames);
+
+       safe_free(q_u);
+}
+
 
 /*******************************************************************
  convert a buffer of UNICODE strings null terminated
@@ -3908,11 +3932,11 @@ BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LE
                
        switch (il->level) {
                case 3:
-                       if(!spool_io_printer_driver_info_level_3("", &(il->info_3), ps, depth))
+                       if(!spool_io_printer_driver_info_level_3("", &il->info_3, ps, depth))
                                return False;
                        break;          
                case 6:
-                       if(!spool_io_printer_driver_info_level_6("", &(il->info_6), ps, depth))
+                       if(!spool_io_printer_driver_info_level_6("", &il->info_6, ps, depth))
                                return False;
                        break;          
        default:
@@ -3922,6 +3946,21 @@ BOOL spool_io_printer_driver_info_level(char *desc, SPOOL_PRINTER_DRIVER_INFO_LE
        return True;
 }
 
+void free_spool_printer_driver_info_level(SPOOL_PRINTER_DRIVER_INFO_LEVEL *il)
+{
+       if (il->ptr==0)
+               return;
+
+       switch (il->level) {
+               case 3:
+                       free_spool_printer_driver_info_level_3(&il->info_3);
+                       break;
+               case 6:
+                       free_spool_printer_driver_info_level_6(&il->info_6);
+                       break;
+       }
+}
+
 /*******************************************************************
 ********************************************************************/  
 BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth)
@@ -3948,6 +3987,15 @@ BOOL spoolss_io_q_addprinterdriver(char *desc, SPOOL_Q_ADDPRINTERDRIVER *q_u, pr
        return True;
 }
 
+/*******************************************************************
+ Free the dynamic parts of a printer driver.
+********************************************************************/  
+
+void free_spoolss_q_addprinterdriver(SPOOL_Q_ADDPRINTERDRIVER *q_u)
+{
+       free_spool_printer_driver_info_level(&q_u->info);
+}
+
 /*******************************************************************
 ********************************************************************/  
 BOOL spoolss_io_r_addprinterdriver(char *desc, SPOOL_R_ADDPRINTERDRIVER *q_u, prs_struct *ps, int depth)

diff --git a/source/rpc_server/srv_spoolss.c b/source/rpc_server/srv_spoolss.c
index 74901efa7854848544de4fac0192dffeb724ee9c..2513fe91e69275f45d51320e82ce56b485517b35 100755 (executable)
--- a/source/rpc_server/srv_spoolss.c
+++ b/source/rpc_server/srv_spoolss.c
@@ -833,9 +833,12 @@ static BOOL api_spoolss_addprinterdriver(prs_struct *data, prs_struct *rdata)
                                
        if(!spoolss_io_r_addprinterdriver("", &r_u, rdata, 0)) {
                DEBUG(0,("spoolss_io_r_addprinterdriver: unable to marshall SPOOL_R_ADDPRINTERDRIVER.\n"));
+               free_spoolss_q_addprinterdriver(&q_u);
                return False;
        }
        
+       free_spoolss_q_addprinterdriver(&q_u);
+
        return True;
 }
 

diff --git a/source/rpc_server/srv_spoolss_nt.c b/source/rpc_server/srv_spoolss_nt.c
index f181585c84e296fa656a549a2672d0e9cca254b3..b77deca1582b1512417b433c2a4fddcafbf1fa77 100644 (file)
--- a/source/rpc_server/srv_spoolss_nt.c
+++ b/source/rpc_server/srv_spoolss_nt.c
@@ -3917,14 +3917,12 @@ uint32 _spoolss_addprinterdriver( const UNISTR2 *server_name,
 
 #ifdef RELIES_ON_SMBD_FUNCTIONS_LINKED_INTO_SPOOLSSD
        if ((err = modify_driver_heirarchy(&driver, level)) != 0) {
-               safe_free(driver.info_3);
-               safe_free(driver.info_6);
+               free_a_printer_driver(driver, level);
                return err;
        }
 #endif
 
-       safe_free(driver.info_3);
-       safe_free(driver.info_6);
+       free_a_printer_driver(driver, level);
 
        return NT_STATUS_NO_PROBLEMO;
 }