Fixing get/set of security descriptors.
[samba.git] / source3 / rpc_server / srv_spoolss_nt.c
index 8f1bcef9f35ad5b33b0d8b3eaffcaff9ebad0f5f..e3552c3879feac1b97b7222880a69f1dd4c5bb1a 100644 (file)
@@ -1,3 +1,4 @@
+#define OLD_NTDOMAIN 1
 /* 
  *  Unix SMB/Netbios implementation.
  *  Version 1.9.
 
 
 #include "includes.h"
-#include "nterr.h"
+
+#ifndef MANGLE_DRIVER_PATH
+#define MANGLE_DRIVER_PATH 0
+#endif
 
 extern int DEBUGLEVEL;
 extern pstring global_myname;
@@ -46,11 +50,7 @@ typedef struct _Printer{
        BOOL open;
        BOOL document_started;
        BOOL page_started;
-       uint32 current_jobid;
-       uint32 document_fd;
-       uint32 document_lastwritten;
-       pstring document_name;
-       pstring job_name;
+       int jobid; /* jobid in printing backend */
        POLICY_HND printer_hnd;
        BOOL printer_type;
        union {
@@ -86,6 +86,33 @@ static ubi_dlList counter_list;
 
 #define OPEN_HANDLE(pnum)    ((pnum!=NULL) && (pnum->open!=False))
 
+/* translate between internal status numbers and NT status numbers */
+static int nt_printj_status(int v)
+{
+       switch (v) {
+       case LPQ_PAUSED:
+               return PRINTER_STATUS_PAUSED;
+       case LPQ_QUEUED:
+       case LPQ_SPOOLING:
+       case LPQ_PRINTING:
+               return 0;
+       }
+       return 0;
+}
+
+static int nt_printq_status(int v)
+{
+       switch (v) {
+       case LPQ_PAUSED:
+               return PRINTER_STATUS_ERROR;
+       case LPQ_QUEUED:
+       case LPQ_SPOOLING:
+       case LPQ_PRINTING:
+               return 0;
+       }
+       return 0;
+}
+
 /****************************************************************************
   initialise printer handle states...
 ****************************************************************************/
@@ -113,7 +140,7 @@ static void create_printer_hnd(POLICY_HND *hnd)
        SIVAL(hnd->data, 4 , prt_hnd_low ); /* second bit is incrementing */
        SIVAL(hnd->data, 8 , prt_hnd_high); /* second bit is incrementing */
        SIVAL(hnd->data, 12, time(NULL));   /* something random */
-       SIVAL(hnd->data, 16, getpid());     /* something more random */
+       SIVAL(hnd->data, 16, sys_getpid());     /* something more random */
 }
 
 /****************************************************************************
@@ -145,7 +172,7 @@ static Printer_entry *find_printer_index_by_hnd(const POLICY_HND *hnd)
 ****************************************************************************/
 static void clear_handle(POLICY_HND *hnd)
 {
-       memset(hnd->data, 0, POLICY_HND_SIZE);
+       ZERO_STRUCTP(hnd);
 }
 
 /****************************************************************************
@@ -178,16 +205,35 @@ static BOOL close_printer_handle(POLICY_HND *hnd)
        return True;
 }      
 
+/****************************************************************************
+  delete a printer given a handle
+****************************************************************************/
+static BOOL delete_printer_handle(POLICY_HND *hnd)
+{
+       Printer_entry *Printer = find_printer_index_by_hnd(hnd);
+
+       if (!OPEN_HANDLE(Printer))
+       {
+               DEBUG(3,("Error closing printer handle\n"));
+               return False;
+       }
+
+       if (del_a_printer(Printer->dev.printername) != 0) {
+               DEBUG(3,("Error deleting printer %s\n", Printer->dev.printername));
+               return False;
+       }
+
+       return True;
+}      
+
 /****************************************************************************
   return the snum of a printer corresponding to an handle
 ****************************************************************************/
 static BOOL get_printer_snum(const POLICY_HND *hnd, int *number)
 {
-       int snum;
        Printer_entry *Printer = find_printer_index_by_hnd(hnd);
-       int n_services=lp_numservices();
                
-       if (!OPEN_HANDLE(Printer))      {
+       if (!OPEN_HANDLE(Printer)) {
                DEBUG(3,("Error getting printer - take a nap quickly !\n"));
                return False;
        }
@@ -195,22 +241,8 @@ static BOOL get_printer_snum(const POLICY_HND *hnd, int *number)
        switch (Printer->printer_type) {
        case PRINTER_HANDLE_IS_PRINTER:            
                DEBUG(4,("short name:%s\n", Printer->dev.printername));                 
-               for (snum=0;snum<n_services; snum++) {
-                       if (lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) ) {
-                               DEBUG(4,("share:%s\n",lp_servicename(snum)));
-                               if (   ( strlen(lp_servicename(snum)) == strlen( Printer->dev.printername ) ) 
-                                   && ( !strncasecmp(lp_servicename(snum), 
-                                                     Printer->dev.printername,
-                                                     strlen( lp_servicename(snum) ))) ) {
-                                       DEBUG(4,("Printer found: %s[%x]\n",lp_servicename(snum),snum));
-                                       *number=snum;
-                                       return True;
-                                       break;  
-                               }
-                       }
-               }
-               return False;
-               break;          
+               *number = print_queue_snum(Printer->dev.printername);
+               return (*number != -1);
        case PRINTER_HANDLE_IS_PRINTSERVER:
                return False;
                break;
@@ -227,7 +259,9 @@ static BOOL open_printer_hnd(POLICY_HND *hnd)
 {
        Printer_entry *new_printer;
 
-       new_printer=(Printer_entry *)malloc(sizeof(Printer_entry));
+       if((new_printer=(Printer_entry *)malloc(sizeof(Printer_entry))) == NULL)
+               return False;
+
        ZERO_STRUCTP(new_printer);
        
        new_printer->open = True;
@@ -299,14 +333,13 @@ static BOOL set_printer_hnd_printertype(POLICY_HND *hnd, char *printername)
 static BOOL set_printer_hnd_printername(POLICY_HND *hnd, char *printername)
 {
        Printer_entry *Printer = find_printer_index_by_hnd(hnd);
-       NT_PRINTER_INFO_LEVEL printer;
+       NT_PRINTER_INFO_LEVEL *printer = NULL;
        int snum;
        int n_services=lp_numservices();
        char *aprinter;
        BOOL found=False;
        
-       if (!OPEN_HANDLE(Printer))
-       {
+       if (!OPEN_HANDLE(Printer)) {
                DEBUG(0,("Error setting printer name=%s\n", printername));
                return False;
        }
@@ -326,6 +359,7 @@ static BOOL set_printer_hnd_printername(POLICY_HND *hnd, char *printername)
        aprinter++;
 
        DEBUGADD(5,("searching for [%s] (len=%d)\n", aprinter, strlen(aprinter)));
+
        /*
         * store the Samba share name in it
         * in back we have the long printer name
@@ -336,7 +370,7 @@ static BOOL set_printer_hnd_printername(POLICY_HND *hnd, char *printername)
 
        for (snum=0;snum<n_services && found==False;snum++) {
        
-               if ( !(lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) ) )
+               if ( !(lp_snum_ok(snum) && lp_print_ok(snum) ) )
                        continue;
                
                DEBUGADD(5,("share:%s\n",lp_servicename(snum)));
@@ -344,31 +378,75 @@ static BOOL set_printer_hnd_printername(POLICY_HND *hnd, char *printername)
                if (get_a_printer(&printer, 2, lp_servicename(snum))!=0)
                        continue;
 
-               if ( strlen(printer.info_2->printername) != strlen(aprinter) ) {
-                       free_a_printer(printer, 2);
+               DEBUG(10,("set_printer_hnd_printername: printername [%s], aprinter [%s]\n", 
+                               printer->info_2->printername, aprinter ));
+
+               if ( strlen(printer->info_2->printername) != strlen(aprinter) ) {
+                       free_a_printer(&printer, 2);
                        continue;
                }
                
-               if ( strncasecmp(printer.info_2->printername, aprinter, strlen(aprinter)))  {
-                       free_a_printer(printer, 2);
+               if ( strncasecmp(printer->info_2->printername, aprinter, strlen(aprinter)))  {
+                       free_a_printer(&printer, 2);
                        continue;
                }
                
                found=True;
        }
 
-       if (found==False)
-       {
+       /* 
+        * if we haven't found a printer with the given printername
+        * then it can be a share name as you can open both \\server\printer and
+        * \\server\share
+        */
+
+       /*
+        * we still check if the printer description file exists as NT won't be happy
+        * if we reply OK in the openprinter call and can't reply in the subsequent RPC calls
+        */
+
+       if (found==False) {
+               DEBUGADD(5,("Printer not found, checking for share now\n"));
+       
+               for (snum=0;snum<n_services && found==False;snum++) {
+       
+                       if ( !(lp_snum_ok(snum) && lp_print_ok(snum) ) )
+                               continue;
+               
+                       DEBUGADD(5,("share:%s\n",lp_servicename(snum)));
+
+                       if (get_a_printer(&printer, 2, lp_servicename(snum))!=0)
+                               continue;
+
+                       DEBUG(10,("set_printer_hnd_printername: printername [%s], aprinter [%s]\n", 
+                                       printer->info_2->printername, aprinter ));
+
+                       if ( strlen(lp_servicename(snum)) != strlen(aprinter) ) {
+                               free_a_printer(&printer, 2);
+                               continue;
+                       }
+               
+                       if ( strncasecmp(lp_servicename(snum), aprinter, strlen(aprinter)))  {
+                               free_a_printer(&printer, 2);
+                               continue;
+                       }
+               
+                       found=True;
+               }
+       }
+               
+       if (found==False) {
                DEBUGADD(4,("Printer not found\n"));
                return False;
        }
        
        snum--;
-       DEBUGADD(4,("Printer found: %s[%x]\n",lp_servicename(snum),snum));
+       DEBUGADD(4,("Printer found: %s -> %s[%x]\n",printer->info_2->printername, lp_servicename(snum),snum));
        ZERO_STRUCT(Printer->dev.printername);
        strncpy(Printer->dev.printername, lp_servicename(snum), strlen(lp_servicename(snum)));
-       free_a_printer(printer, 2);
        
+       free_a_printer(&printer, 2);
+
        return True;
 }
 
@@ -397,7 +475,7 @@ static BOOL alloc_buffer_size(NEW_BUFFER *buffer, uint32 buffer_size)
        uint32 extra_space;
        uint32 old_offset;
        
-       ps=&(buffer->prs);
+       ps= &buffer->prs;
 
        /* damn, I'm doing the reverse operation of prs_grow() :) */
        if (buffer_size < prs_data_size(ps))
@@ -437,7 +515,7 @@ uint32 _spoolss_open_printer_ex( const UNISTR2 *printername,
        clear_handle(handle);
        
        if (printername == NULL)
-               return NT_STATUS_ACCESS_DENIED;
+               return ERROR_INVALID_PRINTER_NAME;
 
        /* some sanity check because you can open a printer or a print server */
        /* aka: \\server\printer or \\server */
@@ -451,12 +529,12 @@ uint32 _spoolss_open_printer_ex( const UNISTR2 *printername,
        
        if (!set_printer_hnd_printertype(handle, name)) {
                close_printer_handle(handle);
-               return NT_STATUS_ACCESS_DENIED;
+               return ERROR_INVALID_PRINTER_NAME;
        }
        
        if (!set_printer_hnd_printername(handle, name)) {
                close_printer_handle(handle);
-               return NT_STATUS_ACCESS_DENIED;
+               return ERROR_INVALID_PRINTER_NAME;
        }
 
 /*
@@ -471,7 +549,7 @@ uint32 _spoolss_open_printer_ex( const UNISTR2 *printername,
        
        if (!set_printer_hnd_accesstype(handle, printer_default->access_required)) {
                close_printer_handle(handle);
-               return NT_STATUS_ACCESS_DENIED;
+               return ERROR_ACCESS_DENIED;
        }
                
        return NT_STATUS_NO_PROBLEMO;
@@ -484,7 +562,7 @@ static BOOL convert_printer_info(const SPOOL_PRINTER_INFO_LEVEL *uni,
 {
        switch (level) {
                case 2: 
-                       uni_2_asc_printer_info_2(uni->info_2, &(printer->info_2));
+                       uni_2_asc_printer_info_2(uni->info_2, &printer->info_2);
                        break;
                default:
                        break;
@@ -499,7 +577,11 @@ static BOOL convert_printer_driver_info(const SPOOL_PRINTER_DRIVER_INFO_LEVEL *u
        switch (level) {
                case 3: 
                        printer->info_3=NULL;
-                       uni_2_asc_printer_driver_3(uni->info_3, &(printer->info_3));                                            
+                       uni_2_asc_printer_driver_3(uni->info_3, &(printer->info_3));
+                       break;
+               case 6: 
+                       printer->info_6=NULL;
+                       uni_2_asc_printer_driver_6(uni->info_6, &(printer->info_6));
                        break;
                default:
                        break;
@@ -508,52 +590,51 @@ static BOOL convert_printer_driver_info(const SPOOL_PRINTER_DRIVER_INFO_LEVEL *u
        return True;
 }
 
-static BOOL convert_devicemode(DEVICEMODE devmode, NT_DEVICEMODE *nt_devmode)
-{
-       unistr_to_ascii(nt_devmode->devicename, devmode.devicename.buffer, 31);
-       unistr_to_ascii(nt_devmode->formname, devmode.formname.buffer, 31);
-
-       nt_devmode->specversion=devmode.specversion;
-       nt_devmode->driverversion=devmode.driverversion;
-       nt_devmode->size=devmode.size;
-       nt_devmode->driverextra=devmode.driverextra;
-       nt_devmode->fields=devmode.fields;
-       nt_devmode->orientation=devmode.orientation;
-       nt_devmode->papersize=devmode.papersize;
-       nt_devmode->paperlength=devmode.paperlength;
-       nt_devmode->paperwidth=devmode.paperwidth;
-       nt_devmode->scale=devmode.scale;
-       nt_devmode->copies=devmode.copies;
-       nt_devmode->defaultsource=devmode.defaultsource;
-       nt_devmode->printquality=devmode.printquality;
-       nt_devmode->color=devmode.color;
-       nt_devmode->duplex=devmode.duplex;
-       nt_devmode->yresolution=devmode.yresolution;
-       nt_devmode->ttoption=devmode.ttoption;
-       nt_devmode->collate=devmode.collate;
-
-       nt_devmode->logpixels=devmode.logpixels;
-       nt_devmode->bitsperpel=devmode.bitsperpel;
-       nt_devmode->pelswidth=devmode.pelswidth;
-       nt_devmode->pelsheight=devmode.pelsheight;
-       nt_devmode->displayflags=devmode.displayflags;
-       nt_devmode->displayfrequency=devmode.displayfrequency;
-       nt_devmode->icmmethod=devmode.icmmethod;
-       nt_devmode->icmintent=devmode.icmintent;
-       nt_devmode->mediatype=devmode.mediatype;
-       nt_devmode->dithertype=devmode.dithertype;
-       nt_devmode->reserved1=devmode.reserved1;
-       nt_devmode->reserved2=devmode.reserved2;
-       nt_devmode->panningwidth=devmode.panningwidth;
-       nt_devmode->panningheight=devmode.panningheight;
-
-       if (nt_devmode->driverextra != 0) 
-       {
+static BOOL convert_devicemode(const DEVICEMODE *devmode, NT_DEVICEMODE *nt_devmode)
+{
+       unistr_to_dos(nt_devmode->devicename, (const char *)devmode->devicename.buffer, 31);
+       unistr_to_dos(nt_devmode->formname, (const char *)devmode->formname.buffer, 31);
+
+       nt_devmode->specversion=devmode->specversion;
+       nt_devmode->driverversion=devmode->driverversion;
+       nt_devmode->size=devmode->size;
+       nt_devmode->driverextra=devmode->driverextra;
+       nt_devmode->fields=devmode->fields;
+       nt_devmode->orientation=devmode->orientation;
+       nt_devmode->papersize=devmode->papersize;
+       nt_devmode->paperlength=devmode->paperlength;
+       nt_devmode->paperwidth=devmode->paperwidth;
+       nt_devmode->scale=devmode->scale;
+       nt_devmode->copies=devmode->copies;
+       nt_devmode->defaultsource=devmode->defaultsource;
+       nt_devmode->printquality=devmode->printquality;
+       nt_devmode->color=devmode->color;
+       nt_devmode->duplex=devmode->duplex;
+       nt_devmode->yresolution=devmode->yresolution;
+       nt_devmode->ttoption=devmode->ttoption;
+       nt_devmode->collate=devmode->collate;
+
+       nt_devmode->logpixels=devmode->logpixels;
+       nt_devmode->bitsperpel=devmode->bitsperpel;
+       nt_devmode->pelswidth=devmode->pelswidth;
+       nt_devmode->pelsheight=devmode->pelsheight;
+       nt_devmode->displayflags=devmode->displayflags;
+       nt_devmode->displayfrequency=devmode->displayfrequency;
+       nt_devmode->icmmethod=devmode->icmmethod;
+       nt_devmode->icmintent=devmode->icmintent;
+       nt_devmode->mediatype=devmode->mediatype;
+       nt_devmode->dithertype=devmode->dithertype;
+       nt_devmode->reserved1=devmode->reserved1;
+       nt_devmode->reserved2=devmode->reserved2;
+       nt_devmode->panningwidth=devmode->panningwidth;
+       nt_devmode->panningheight=devmode->panningheight;
+
+       if (nt_devmode->driverextra != 0) {
                /* if we had a previous private delete it and make a new one */
-               if (nt_devmode->private != NULL)
-                       free(nt_devmode->private);
-               nt_devmode->private=(uint8 *)malloc(nt_devmode->driverextra * sizeof(uint8));
-               memcpy(nt_devmode->private, devmode.private, nt_devmode->driverextra);
+               safe_free(nt_devmode->private);
+               if((nt_devmode->private=(uint8 *)malloc(nt_devmode->driverextra * sizeof(uint8))) == NULL)
+                       return False;
+               memcpy(nt_devmode->private, devmode->private, nt_devmode->driverextra);
        }
 
        return True;
@@ -565,7 +646,18 @@ static BOOL convert_devicemode(DEVICEMODE devmode, NT_DEVICEMODE *nt_devmode)
 uint32 _spoolss_closeprinter(POLICY_HND *handle)
 {
        if (!close_printer_handle(handle))
-               return NT_STATUS_INVALID_HANDLE;        
+               return ERROR_INVALID_HANDLE;    
+               
+       return NT_STATUS_NO_PROBLEMO;
+}
+
+/********************************************************************
+ * api_spoolss_deleteprinter
+ ********************************************************************/
+uint32 _spoolss_deleteprinter(POLICY_HND *handle)
+{
+       if (!delete_printer_handle(handle))
+               return ERROR_INVALID_HANDLE;    
                
        return NT_STATUS_NO_PROBLEMO;
 }
@@ -579,68 +671,66 @@ static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **d
        
        DEBUG(8,("getprinterdata_printer_server:%s\n", value));
                
-       if (!strcmp(value, "BeepEnabled"))
-       {
+       if (!strcmp(value, "BeepEnabled")) {
                *type = 0x4;
-               *data = (uint8 *)malloc( 4*sizeof(uint8) );
+               if((*data = (uint8 *)malloc( 4*sizeof(uint8) )) == NULL)
+                       return False;
                SIVAL(*data, 0, 0x01);
                *needed = 0x4;                  
                return True;
        }
 
-       if (!strcmp(value, "EventLog"))
-       {
+       if (!strcmp(value, "EventLog")) {
                *type = 0x4;
-               *data = (uint8 *)malloc( 4*sizeof(uint8) );
+               if((*data = (uint8 *)malloc( 4*sizeof(uint8) )) == NULL)
+                       return False;
                SIVAL(*data, 0, 0x1B);
                *needed = 0x4;                  
                return True;
        }
 
-       if (!strcmp(value, "NetPopup"))
-       {
+       if (!strcmp(value, "NetPopup")) {
                *type = 0x4;
-               *data = (uint8 *)malloc( 4*sizeof(uint8) );
+               if((*data = (uint8 *)malloc( 4*sizeof(uint8) )) == NULL)
+                       return False;
                SIVAL(*data, 0, 0x01);
                *needed = 0x4;
                return True;
        }
 
-       if (!strcmp(value, "MajorVersion"))
-       {
+       if (!strcmp(value, "MajorVersion")) {
                *type = 0x4;
-               *data = (uint8 *)malloc( 4*sizeof(uint8) );
+               if((*data = (uint8 *)malloc( 4*sizeof(uint8) )) == NULL)
+                       return False;
                SIVAL(*data, 0, 0x02);
                *needed = 0x4;
                return True;
        }
 
-       if (!strcmp(value, "DefaultSpoolDirectory"))
-       {
+       if (!strcmp(value, "DefaultSpoolDirectory")) {
                pstring string="You are using a Samba server";
                *type = 0x1;                    
                *needed = 2*(strlen(string)+1);         
-               *data  = (uint8 *)malloc( ((*needed > in_size) ? *needed:in_size) *sizeof(uint8));
+               if((*data  = (uint8 *)malloc( ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
+                       return False;
                memset(*data, 0, (*needed > in_size) ? *needed:in_size);
                
                /* it's done by hand ready to go on the wire */
-               for (i=0; i<strlen(string); i++)
-               {
+               for (i=0; i<strlen(string); i++) {
                        (*data)[2*i]=string[i];
                        (*data)[2*i+1]='\0';
                }                       
                return True;
        }
 
-       if (!strcmp(value, "Architecture"))
-       {                       
+       if (!strcmp(value, "Architecture")) {                   
                pstring string="Windows NT x86";
                *type = 0x1;                    
                *needed = 2*(strlen(string)+1); 
-               *data  = (uint8 *)malloc( ((*needed > in_size) ? *needed:in_size) *sizeof(uint8));
+               if((*data  = (uint8 *)malloc( ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
+                       return False;
                memset(*data, 0, (*needed > in_size) ? *needed:in_size);
-               for (i=0; i<strlen(string); i++)
-               {
+               for (i=0; i<strlen(string); i++) {
                        (*data)[2*i]=string[i];
                        (*data)[2*i+1]='\0';
                }                       
@@ -657,7 +747,7 @@ static BOOL getprinterdata_printer(const POLICY_HND *handle,
                                fstring value, uint32 *type, 
                                uint8 **data, uint32 *needed, uint32 in_size )
 {
-       NT_PRINTER_INFO_LEVEL printer;
+       NT_PRINTER_INFO_LEVEL *printer = NULL;
        int snum=0;
        uint8 *idata=NULL;
        uint32 len;
@@ -665,25 +755,43 @@ static BOOL getprinterdata_printer(const POLICY_HND *handle,
        
        DEBUG(5,("getprinterdata_printer\n"));
 
-       if (OPEN_HANDLE(Printer))
-       {
-               get_printer_snum(handle, &snum);                
-               get_a_printer(&printer, 2, lp_servicename(snum));
-               
-               if (get_specific_param(printer, 2, value, &idata, type, &len)) 
-               {
-                       *data  = (uint8 *)malloc( (len>in_size)?len:in_size *sizeof(uint8) );
-                       memset(*data, 0, sizeof(uint8)*len);
-                       memcpy(*data, idata, (len>in_size)?len:in_size);
-                       *needed = len;
-                       
-                       if (idata) free(idata);
-                       return (True);
+       if (!OPEN_HANDLE(Printer))
+               return False;
+
+       if(!get_printer_snum(handle, &snum))
+               return False;
+
+       if(get_a_printer(&printer, 2, lp_servicename(snum)) != 0)
+               return False;
+
+       if (!get_specific_param(*printer, 2, value, &idata, type, &len)) {
+               free_a_printer(&printer, 2);
+               return False;
+       }
+
+       free_a_printer(&printer, 2);
+
+       DEBUG(5,("getprinterdata_printer:allocating %d\n", in_size));
+
+       if (in_size) {
+               if((*data  = (uint8 *)malloc( in_size *sizeof(uint8) )) == NULL) {
+                       return False;
                }
-               free_a_printer(printer, 2);
+
+               memset(*data, 0, in_size *sizeof(uint8));
+               /* copy the min(in_size, len) */
+               memcpy(*data, idata, (len>in_size)?in_size:len *sizeof(uint8));
+       } else {
+               *data = NULL;
        }
 
-       return (False);
+       *needed = len;
+       
+       DEBUG(5,("getprinterdata_printer:copy done\n"));
+                       
+       safe_free(idata);
+       
+       return True;
 }      
 
 /********************************************************************
@@ -716,8 +824,9 @@ uint32 _spoolss_getprinterdata(const POLICY_HND *handle, UNISTR2 *valuename,
        DEBUG(4,("_spoolss_getprinterdata\n"));
        
        if (!OPEN_HANDLE(Printer)) {
-               *data=(uint8 *)malloc(4*sizeof(uint8));
-               return NT_STATUS_INVALID_HANDLE;
+               if((*data=(uint8 *)malloc(4*sizeof(uint8))) == NULL)
+                       return ERROR_NOT_ENOUGH_MEMORY;
+               return ERROR_INVALID_HANDLE;
        }
        
        unistr2_to_ascii(value, valuename, sizeof(value)-1);
@@ -728,9 +837,16 @@ uint32 _spoolss_getprinterdata(const POLICY_HND *handle, UNISTR2 *valuename,
                found=getprinterdata_printer(handle, value, type, data, needed, *out_size);
 
        if (found==False) {
+               DEBUG(5, ("value not found, allocating %d\n", *out_size));
                /* reply this param doesn't exist */
-               *data=(uint8 *)malloc(4*sizeof(uint8));
-               memset(*data, 0x0, 4);
+               if (*out_size) {
+                       if((*data=(uint8 *)malloc(*out_size*sizeof(uint8))) == NULL)
+                               return ERROR_NOT_ENOUGH_MEMORY;
+                       memset(*data, '\0', *out_size*sizeof(uint8));
+               } else {
+                       *data = NULL;
+               }
+
                return ERROR_INVALID_PARAMETER;
        }
        
@@ -760,7 +876,7 @@ uint32 _spoolss_rffpcnex(const POLICY_HND *handle, uint32 flags, uint32 options,
        Printer_entry *Printer=find_printer_index_by_hnd(handle);
 
        if (!OPEN_HANDLE(Printer))
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
 
        Printer->notify.flags=flags;
        Printer->notify.options=options;
@@ -774,28 +890,30 @@ uint32 _spoolss_rffpcnex(const POLICY_HND *handle, uint32 flags, uint32 options,
 /*******************************************************************
  * fill a notify_info_data with the servername
  ********************************************************************/
-static void spoolss_notify_server_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_server_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue,
+                                                                               NT_PRINTER_INFO_LEVEL *printer)
 {
        pstring temp_name;
 
-       snprintf(temp_name, sizeof(temp_name), "\\\\%s", global_myname);
+       snprintf(temp_name, sizeof(temp_name)-1, "\\\\%s", global_myname);
 
        data->notify_data.data.length=strlen(temp_name);
-       ascii_to_unistr(data->notify_data.data.string, temp_name, sizeof(data->notify_data.data.string)-1);
+       ascii_to_unistr((char *)data->notify_data.data.string, temp_name, sizeof(data->notify_data.data.string)-1);
 }
 
 /*******************************************************************
  * fill a notify_info_data with the servicename
  * jfmxxxx: it's incorrect should be long_printername
  ********************************************************************/
-static void spoolss_notify_printer_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_printer_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue,
+                                                                               NT_PRINTER_INFO_LEVEL *printer)
 {
 /*
        data->notify_data.data.length=strlen(lp_servicename(snum));
        ascii_to_unistr(data->notify_data.data.string, lp_servicename(snum), sizeof(data->notify_data.data.string)-1);
 */
        data->notify_data.data.length=strlen(printer->info_2->printername);
-       ascii_to_unistr(data->notify_data.data.string, 
+       ascii_to_unistr((char *)data->notify_data.data.string, 
                        printer->info_2->printername, 
                        sizeof(data->notify_data.data.string)-1);
 }
@@ -806,7 +924,7 @@ static void spoolss_notify_printer_name(int snum, SPOOL_NOTIFY_INFO_DATA *data,
 static void spoolss_notify_share_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
 {
        data->notify_data.data.length=strlen(lp_servicename(snum));
-       ascii_to_unistr(data->notify_data.data.string,
+       ascii_to_unistr((char *)data->notify_data.data.string,
                        lp_servicename(snum), 
                        sizeof(data->notify_data.data.string)-1);
 }
@@ -819,7 +937,7 @@ static void spoolss_notify_port_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, pri
        /* even if it's strange, that's consistant in all the code */
 
        data->notify_data.data.length=strlen(lp_servicename(snum));
-       ascii_to_unistr(data->notify_data.data.string,
+       ascii_to_unistr((char *)data->notify_data.data.string,
                        lp_servicename(snum), 
                        sizeof(data->notify_data.data.string)-1);
 }
@@ -832,7 +950,7 @@ static void spoolss_notify_port_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, pri
 static void spoolss_notify_driver_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
 {
        data->notify_data.data.length=strlen(printer->info_2->drivername);
-       ascii_to_unistr(data->notify_data.data.string, 
+       ascii_to_unistr((char *)data->notify_data.data.string, 
                        printer->info_2->drivername, 
                        sizeof(data->notify_data.data.string)-1);
 }
@@ -843,7 +961,7 @@ static void spoolss_notify_driver_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, p
 static void spoolss_notify_comment(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
 {
        data->notify_data.data.length=strlen(lp_comment(snum));
-       ascii_to_unistr(data->notify_data.data.string,
+       ascii_to_unistr((char *)data->notify_data.data.string,
                        lp_comment(snum),
                        sizeof(data->notify_data.data.string)-1);
 }
@@ -856,7 +974,7 @@ static void spoolss_notify_comment(int snum, SPOOL_NOTIFY_INFO_DATA *data, print
 static void spoolss_notify_location(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
 {
        data->notify_data.data.length=strlen(printer->info_2->location);
-       ascii_to_unistr(data->notify_data.data.string, 
+       ascii_to_unistr((char *)data->notify_data.data.string, 
                        printer->info_2->location, 
                        sizeof(data->notify_data.data.string)-1);
 }
@@ -877,7 +995,7 @@ static void spoolss_notify_devmode(int snum, SPOOL_NOTIFY_INFO_DATA *data, print
 static void spoolss_notify_sepfile(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
 {
        data->notify_data.data.length=strlen(printer->info_2->sepfile);
-       ascii_to_unistr(data->notify_data.data.string, 
+       ascii_to_unistr((char *)data->notify_data.data.string, 
                        printer->info_2->sepfile, 
                        sizeof(data->notify_data.data.string)-1);
 }
@@ -889,7 +1007,7 @@ static void spoolss_notify_sepfile(int snum, SPOOL_NOTIFY_INFO_DATA *data, print
 static void spoolss_notify_print_processor(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
 {
        data->notify_data.data.length=strlen(printer->info_2->printprocessor);
-       ascii_to_unistr(data->notify_data.data.string, 
+       ascii_to_unistr((char *)data->notify_data.data.string, 
                        printer->info_2->printprocessor, 
                        sizeof(data->notify_data.data.string)-1);
 }
@@ -901,7 +1019,7 @@ static void spoolss_notify_print_processor(int snum, SPOOL_NOTIFY_INFO_DATA *dat
 static void spoolss_notify_parameters(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
 {
        data->notify_data.data.length=strlen(printer->info_2->parameters);
-       ascii_to_unistr(data->notify_data.data.string, 
+       ascii_to_unistr((char *)data->notify_data.data.string, 
                        printer->info_2->parameters, 
                        sizeof(data->notify_data.data.string)-1);
 }
@@ -913,7 +1031,7 @@ static void spoolss_notify_parameters(int snum, SPOOL_NOTIFY_INFO_DATA *data, pr
 static void spoolss_notify_datatype(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
 {
        data->notify_data.data.length=strlen(printer->info_2->datatype);
-       ascii_to_unistr(data->notify_data.data.string, 
+       ascii_to_unistr((char *)data->notify_data.data.string, 
                        printer->info_2->datatype, 
                        sizeof(data->notify_data.data.string)-1);
 }
@@ -982,9 +1100,9 @@ static void spoolss_notify_status(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_
        print_status_struct status;
 
        memset(&status, 0, sizeof(status));
-       count=get_printqueue(snum, NULL, &q, &status);
+       count = print_queue_status(snum, &q, &status);
        data->notify_data.value[0]=(uint32) status.status;
-       if (q) free(q);
+       safe_free(q);
 }
 
 /*******************************************************************
@@ -996,8 +1114,8 @@ static void spoolss_notify_cjobs(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_q
        print_status_struct status;
 
        memset(&status, 0, sizeof(status));
-       data->notify_data.value[0]=get_printqueue(snum, NULL, &q, &status);
-       if (q) free(q);
+       data->notify_data.value[0] = print_queue_status(snum, &q, &status);
+       safe_free(q);
 }
 
 /*******************************************************************
@@ -1016,7 +1134,7 @@ static void spoolss_notify_average_ppm(int snum, SPOOL_NOTIFY_INFO_DATA *data, p
 static void spoolss_notify_username(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
 {
        data->notify_data.data.length=strlen(queue->user);
-       ascii_to_unistr(data->notify_data.data.string, queue->user, sizeof(data->notify_data.data.string)-1);
+       ascii_to_unistr((char *)data->notify_data.data.string, queue->user, sizeof(data->notify_data.data.string)-1);
 }
 
 /*******************************************************************
@@ -1024,7 +1142,7 @@ static void spoolss_notify_username(int snum, SPOOL_NOTIFY_INFO_DATA *data, prin
  ********************************************************************/
 static void spoolss_notify_job_status(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
 {
-       data->notify_data.value[0]=queue->status;
+       data->notify_data.value[0]=nt_printj_status(queue->status);
 }
 
 /*******************************************************************
@@ -1033,7 +1151,7 @@ static void spoolss_notify_job_status(int snum, SPOOL_NOTIFY_INFO_DATA *data, pr
 static void spoolss_notify_job_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
 {
        data->notify_data.data.length=strlen(queue->file);
-       ascii_to_unistr(data->notify_data.data.string, queue->file, sizeof(data->notify_data.data.string)-1);
+       ascii_to_unistr((char *)data->notify_data.data.string, queue->file, sizeof(data->notify_data.data.string)-1);
 }
 
 /*******************************************************************
@@ -1041,8 +1159,23 @@ static void spoolss_notify_job_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, prin
  ********************************************************************/
 static void spoolss_notify_job_status_string(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
 {
-       data->notify_data.data.length=strlen("En attente");
-       ascii_to_unistr(data->notify_data.data.string, "En attente", sizeof(data->notify_data.data.string)-1);
+       char *p = "unknown";
+       switch (queue->status) {
+       case LPQ_QUEUED:
+               p = "QUEUED";
+               break;
+       case LPQ_PAUSED:
+               p = "PAUSED";
+               break;
+       case LPQ_SPOOLING:
+               p = "SPOOLING";
+               break;
+       case LPQ_PRINTING:
+               p = "PRINTING";
+               break;
+       }
+       data->notify_data.data.length=strlen(p);
+       ascii_to_unistr((char *)data->notify_data.data.string, p, sizeof(data->notify_data.data.string)-1);
 }
 
 /*******************************************************************
@@ -1071,6 +1204,17 @@ static void spoolss_notify_job_position(int snum, SPOOL_NOTIFY_INFO_DATA *data,
 
 #define END 65535
 
+struct s_notify_info_data_table
+{
+       uint16 type;
+       uint16 field;
+       char *name;
+       uint32 size;
+       void (*fn) (int snum, SPOOL_NOTIFY_INFO_DATA *data,
+                   print_queue_struct *queue,
+                   NT_PRINTER_INFO_LEVEL *printer);
+};
+
 struct s_notify_info_data_table notify_info_data_table[] =
 {
 { PRINTER_NOTIFY_TYPE, PRINTER_NOTIFY_SERVER_NAME,         "PRINTER_NOTIFY_SERVER_NAME",         POINTER,   spoolss_notify_server_name },
@@ -1219,7 +1363,7 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int snum, SPO
        uint16 field;
 
        SPOOL_NOTIFY_INFO_DATA *current_data;
-       NT_PRINTER_INFO_LEVEL printer;
+       NT_PRINTER_INFO_LEVEL *printer = NULL;
        print_queue_struct *queue=NULL;
        
        DEBUG(4,("construct_notify_printer_info\n"));
@@ -1231,9 +1375,7 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int snum, SPO
                option_type->count, lp_servicename(snum)));
        
        if (get_a_printer(&printer, 2, lp_servicename(snum))!=0)
-       {
                return False;
-       }
 
        for(field_num=0; field_num<option_type->count; field_num++)
        {
@@ -1243,16 +1385,18 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int snum, SPO
                if (!search_notify(type, field, &j) )
                        continue;
                
-               info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA));
+               if((info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
+                       return False;
+               }
                current_data=&(info->data[info->count]);
 
                construct_info_data(current_data, type, field, id);             
-               notify_info_data_table[j].fn(snum, current_data, queue, &printer);
+               notify_info_data_table[j].fn(snum, current_data, queue, printer);
 
                info->count++;
        }
 
-       free_a_printer(printer, 2);
+       free_a_printer(&printer, 2);
        return True;
 }
 
@@ -1268,7 +1412,7 @@ static BOOL construct_notify_jobs_info(print_queue_struct *queue, SPOOL_NOTIFY_I
        uint16 field;
 
        SPOOL_NOTIFY_INFO_DATA *current_data;
-       NT_PRINTER_INFO_LEVEL printer;
+       NT_PRINTER_INFO_LEVEL *printer = NULL;
        
        DEBUG(4,("construct_notify_jobs_info\n"));
        
@@ -1279,27 +1423,26 @@ static BOOL construct_notify_jobs_info(print_queue_struct *queue, SPOOL_NOTIFY_I
                option_type->count));
 
        if (get_a_printer(&printer, 2, lp_servicename(snum))!=0)
-       {       
                return False;
-       }
        
-       for(field_num=0; field_num<option_type->count; field_num++)
-       {
+       for(field_num=0; field_num<option_type->count; field_num++) {
                field = option_type->fields[field_num];
 
                if (!search_notify(type, field, &j) )
                        continue;
 
-               info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA));
+               if((info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
+                       return False;
+               }
+
                current_data=&(info->data[info->count]);
 
                construct_info_data(current_data, type, field, id);
-               notify_info_data_table[j].fn(snum, current_data, queue, &printer);
+               notify_info_data_table[j].fn(snum, current_data, queue, printer);
                info->count++;
        }
-       
-       free_a_printer(printer, 2);
-       
+
+       free_a_printer(&printer, 2);    
        return True;
 }
 
@@ -1404,7 +1547,7 @@ static uint32 printer_notify_info(const POLICY_HND *hnd, SPOOL_NOTIFY_INFO *info
        DEBUG(4,("printer_notify_info\n"));
 
        option=Printer->notify.option;
-       id=1;
+       id=0xffffffff;
        info->version=2;
        info->data=NULL;
        info->count=0;
@@ -1418,15 +1561,14 @@ static uint32 printer_notify_info(const POLICY_HND *hnd, SPOOL_NOTIFY_INFO *info
                switch ( option_type->type ) {
                case PRINTER_NOTIFY_TYPE:
                        if(construct_notify_printer_info(info, snum, option_type, id))
-                               id++;
+                               id--;
                        break;
                        
                case JOB_NOTIFY_TYPE:
                        memset(&status, 0, sizeof(status));     
-                       count=get_printqueue(snum, NULL, &queue, &status);
+                       count = print_queue_status(snum, &queue, &status);
                        for (j=0; j<count; j++)
-                               if (construct_notify_jobs_info(&(queue[j]), info, snum, option_type, id))
-                                       id++;
+                               construct_notify_jobs_info(&(queue[j]), info, snum, option_type, queue[j].job);
                        safe_free(queue);
                        break;
                }
@@ -1459,7 +1601,7 @@ uint32 _spoolss_rfnpcnex( const POLICY_HND *handle, uint32 change,
        Printer_entry *Printer=find_printer_index_by_hnd(handle);
 
        if (!OPEN_HANDLE(Printer))
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
 
        DEBUG(4,("Printer type %x\n",Printer->printer_type));
 
@@ -1478,8 +1620,6 @@ uint32 _spoolss_rfnpcnex( const POLICY_HND *handle, uint32 change,
        if (option!=NULL)
                safe_free(option->ctr.type);
        
-       safe_free(option);
-
        switch (Printer->printer_type) {
                case PRINTER_HANDLE_IS_PRINTSERVER:
                        return printserver_notify_info(handle, info);
@@ -1489,21 +1629,22 @@ uint32 _spoolss_rfnpcnex( const POLICY_HND *handle, uint32 change,
                        break;
        }
 
-       return NT_STATUS_INVALID_INFO_CLASS;
+       return ERROR_INVALID_HANDLE;
 }
 
 /********************************************************************
  * construct_printer_info_0
  * fill a printer_info_1 struct
  ********************************************************************/
-static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum, pstring servername)
+static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum, fstring servername)
 {
        pstring chaine;
        int count;
-       NT_PRINTER_INFO_LEVEL ntprinter;
+       NT_PRINTER_INFO_LEVEL *ntprinter = NULL;
        counter_printer_0 *session_counter;
        uint32 global_counter;
        struct tm *t;
+       time_t setup_time = time(NULL);
 
        print_queue_struct *queue=NULL;
        print_status_struct status;
@@ -1513,7 +1654,7 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum, pstring
        if (get_a_printer(&ntprinter, 2, lp_servicename(snum)) != 0)
                return False;
 
-       count=get_printqueue(snum, NULL, &queue, &status);
+       count = print_queue_status(snum, &queue, &status);
 
        /* check if we already have a counter for this printer */       
        session_counter = (counter_printer_0 *)ubi_dlFirst(&counter_list);
@@ -1525,7 +1666,10 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum, pstring
 
        /* it's the first time, add it to the list */
        if (session_counter==NULL) {
-               session_counter=(counter_printer_0 *)malloc(sizeof(counter_printer_0));
+               if((session_counter=(counter_printer_0 *)malloc(sizeof(counter_printer_0))) == NULL) {
+                       free_a_printer(&ntprinter, 2);
+                       return False;
+               }
                ZERO_STRUCTP(session_counter);
                session_counter->snum=snum;
                session_counter->counter=0;
@@ -1542,7 +1686,7 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum, pstring
        global_counter=session_counter->counter;
        
        /* the description and the name are of the form \\server\share */
-       slprintf(chaine,sizeof(chaine)-1,"\\\\%s\\%s",servername, ntprinter.info_2->printername);
+       slprintf(chaine,sizeof(chaine)-1,"\\\\%s\\%s",servername, ntprinter->info_2->printername);
                                                            
        init_unistr(&(printer->printername), chaine);
        
@@ -1553,7 +1697,8 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum, pstring
        printer->total_jobs = 0;
        printer->total_bytes = 0;
 
-       t=gmtime(&ntprinter.info_2->setuptime);
+       t=gmtime(&setup_time);
+       ntprinter->info_2->setuptime = (uint32)setup_time; /* FIXME !! */
 
        printer->year = t->tm_year+1900;
        printer->month = t->tm_mon+1;
@@ -1570,7 +1715,7 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum, pstring
        printer->build_version = 0x0565;        /* build 1381 */
        printer->unknown7 = 0x1;
        printer->unknown8 = 0x0;
-       printer->unknown9 = 0x2;
+       printer->unknown9 = 0x0;
        printer->session_counter = session_counter->counter;
        printer->unknown11 = 0x0;
        printer->printer_errors = 0x0;          /* number of print failure */
@@ -1578,11 +1723,11 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum, pstring
        printer->unknown14 = 0x1;
        printer->unknown15 = 0x024a;            /* 586 Pentium ? */
        printer->unknown16 = 0x0;
-       printer->change_id = ntprinter.info_2->changeid; /* ChangeID in milliseconds*/
+       printer->change_id = ntprinter->info_2->changeid; /* ChangeID in milliseconds*/
        printer->unknown18 = 0x0;
-       printer->status = status.status;
+       printer->status = nt_printq_status(status.status);
        printer->unknown20 = 0x0;
-       printer->c_setprinter = ntprinter.info_2->c_setprinter; /* how many times setprinter has been called */
+       printer->c_setprinter = ntprinter->info_2->c_setprinter; /* how many times setprinter has been called */
        printer->unknown22 = 0x0;
        printer->unknown23 = 0x6;               /* 6  ???*/
        printer->unknown24 = 0;                 /* unknown 24 to 26 are always 0 */
@@ -1593,8 +1738,7 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum, pstring
        printer->unknown29 = 0;
        
        safe_free(queue);
-
-       free_a_printer(ntprinter, 2);
+       free_a_printer(&ntprinter,2);
        return (True);  
 }
 
@@ -1606,53 +1750,83 @@ static BOOL construct_printer_info_1(fstring server, uint32 flags, PRINTER_INFO_
 {
        pstring chaine;
        pstring chaine2;
-       NT_PRINTER_INFO_LEVEL ntprinter;
+       NT_PRINTER_INFO_LEVEL *ntprinter = NULL;
 
        if (get_a_printer(&ntprinter, 2, lp_servicename(snum)) != 0)
                return False;
 
        printer->flags=flags;
 
-       snprintf(chaine,sizeof(chaine)-1,"%s%s,%s,%s",server, ntprinter.info_2->printername,
-               ntprinter.info_2->drivername, lp_comment(snum));
+       snprintf(chaine,sizeof(chaine)-1,"%s%s,%s,%s",server, ntprinter->info_2->printername,
+               ntprinter->info_2->drivername, lp_comment(snum));
                
-       snprintf(chaine2,sizeof(chaine)-1,"%s%s", server, ntprinter.info_2->printername);
+       snprintf(chaine2,sizeof(chaine)-1,"%s%s", server, ntprinter->info_2->printername);
 
        init_unistr(&printer->description, chaine);
        init_unistr(&printer->name, chaine2);   
        init_unistr(&printer->comment, lp_comment(snum));
        
-       free_a_printer(ntprinter, 2);
+       free_a_printer(&ntprinter,2);
 
        return True;
 }
 
 /****************************************************************************
+ Free a DEVMODE struct.
+****************************************************************************/
+
+static void free_dev_mode(DEVICEMODE *dev)
+{
+       if (dev == NULL)
+               return;
+
+       if (dev->private)
+               safe_free(dev->private);
+
+       safe_free(dev); 
+}
+
+/****************************************************************************
+ Create a DEVMODE struct. Returns malloced memory.
 ****************************************************************************/
-static void construct_dev_mode(DEVICEMODE *devmode, int snum, char *servername)
+
+static DEVICEMODE *construct_dev_mode(int snum, char *servername)
 {
        char adevice[32];
        char aform[32];
-       NT_PRINTER_INFO_LEVEL printer;  
-       NT_DEVICEMODE *ntdevmode;
+       NT_PRINTER_INFO_LEVEL *printer = NULL;
+       NT_DEVICEMODE *ntdevmode = NULL;
+       DEVICEMODE *devmode = NULL;
 
        DEBUG(7,("construct_dev_mode\n"));
        
-       memset(&(devmode->devicename), 0, 2*sizeof(adevice));
-       memset(&(devmode->formname), 0, 2*sizeof(aform));
-
        DEBUGADD(8,("getting printer characteristics\n"));
 
-       get_a_printer(&printer, 2, lp_servicename(snum));
-       ntdevmode=(printer.info_2)->devmode;
+       if ((devmode = (DEVICEMODE *)malloc(sizeof(DEVICEMODE))) == NULL) {
+               DEBUG(0,("construct_dev_mode: malloc fail.\n"));
+               return NULL;
+       }
+
+       ZERO_STRUCTP(devmode);  
+
+       if(get_a_printer(&printer, 2, lp_servicename(snum)) != 0)
+               goto fail;
+
+       if (printer->info_2->devmode)
+               ntdevmode = dup_nt_devicemode(printer->info_2->devmode);
+       else
+               ntdevmode = construct_nt_devicemode();
+
+       if (ntdevmode == NULL)
+               goto fail;
 
        DEBUGADD(8,("loading DEVICEMODE\n"));
        snprintf(adevice, sizeof(adevice), "\\\\%s\\%s", global_myname, 
-                                                        printer.info_2->printername);
-       init_unistr(&(devmode->devicename), adevice);
+                                                        printer->info_2->printername);
+       init_unistr(&devmode->devicename, adevice);
 
        snprintf(aform, sizeof(aform), ntdevmode->formname);
-       init_unistr(&(devmode->formname), aform);
+       init_unistr(&devmode->formname, aform);
 
        devmode->specversion      = ntdevmode->specversion;
        devmode->driverversion    = ntdevmode->driverversion;
@@ -1678,27 +1852,39 @@ static void construct_dev_mode(DEVICEMODE *devmode, int snum, char *servername)
        devmode->mediatype        = ntdevmode->mediatype;
        devmode->dithertype       = ntdevmode->dithertype;
 
-       if (ntdevmode->private != NULL)
-       {
-               devmode->private=(uint8 *)malloc(devmode->driverextra*sizeof(uint8));
-               memcpy(devmode->private, ntdevmode->private, devmode->driverextra);
+       if (ntdevmode->private != NULL) {
+               if ((devmode->private=(uint8 *)memdup(ntdevmode->private, ntdevmode->driverextra)) == NULL)
+                       goto fail;
        }
 
-       free_a_printer(printer, 2);
+       free_nt_devicemode(&ntdevmode);
+       free_a_printer(&printer,2);
+
+       return devmode;
+
+  fail:
+
+       if (ntdevmode)
+               free_nt_devicemode(&ntdevmode);
+       if (printer)
+               free_a_printer(&printer,2);
+       free_dev_mode(devmode);
+
+       return NULL;
 }
 
 /********************************************************************
  * construct_printer_info_2
  * fill a printer_info_2 struct
  ********************************************************************/
-static BOOL construct_printer_info_2(pstring servername, PRINTER_INFO_2 *printer, int snum)
+
+static BOOL construct_printer_info_2(fstring servername, PRINTER_INFO_2 *printer, int snum)
 {
        pstring chaine;
        pstring chaine2;
        pstring sl;
        int count;
-       DEVICEMODE *devmode;
-       NT_PRINTER_INFO_LEVEL ntprinter;
+       NT_PRINTER_INFO_LEVEL *ntprinter = NULL;
 
        print_queue_struct *queue=NULL;
        print_status_struct status;
@@ -1708,7 +1894,7 @@ static BOOL construct_printer_info_2(pstring servername, PRINTER_INFO_2 *printer
                return False;
                
        memset(&status, 0, sizeof(status));             
-       count=get_printqueue(snum, NULL, &queue, &status);
+       count = print_queue_status(snum, &queue, &status);
 
        snprintf(chaine, sizeof(chaine)-1, "%s", servername);
 
@@ -1717,39 +1903,89 @@ static BOOL construct_printer_info_2(pstring servername, PRINTER_INFO_2 *printer
        else
                fstrcpy(sl, '\0');
 
-       snprintf(chaine2, sizeof(chaine)-1, "%s%s%s", servername, sl, ntprinter.info_2->printername);
+       snprintf(chaine2, sizeof(chaine)-1, "%s%s%s", servername, sl, ntprinter->info_2->printername);
 
        init_unistr(&printer->servername, chaine);                              /* servername*/
        init_unistr(&printer->printername, chaine2);                            /* printername*/
        init_unistr(&printer->sharename, lp_servicename(snum));                 /* sharename */
        init_unistr(&printer->portname, lp_servicename(snum));                  /* port */      
-       init_unistr(&printer->drivername, ntprinter.info_2->drivername);        /* drivername */
+       init_unistr(&printer->drivername, ntprinter->info_2->drivername);       /* drivername */
        init_unistr(&printer->comment, lp_comment(snum));                       /* comment */   
-       init_unistr(&printer->location, ntprinter.info_2->location);            /* location */  
-       init_unistr(&printer->sepfile, ntprinter.info_2->sepfile);              /* separator file */
-       init_unistr(&printer->printprocessor, ntprinter.info_2->printprocessor);/* print processor */
-       init_unistr(&printer->datatype, ntprinter.info_2->datatype);            /* datatype */  
-       init_unistr(&printer->parameters, ntprinter.info_2->parameters);        /* parameters (of print processor) */   
-
-       printer->attributes =   PRINTER_ATTRIBUTE_SHARED   \
-                             | PRINTER_ATTRIBUTE_LOCAL  \
-                             | PRINTER_ATTRIBUTE_RAW_ONLY ;                    /* attributes */
-
-       printer->priority = ntprinter.info_2->priority;                         /* priority */  
-       printer->defaultpriority = ntprinter.info_2->default_priority;          /* default priority */
-       printer->starttime = ntprinter.info_2->starttime;                       /* starttime */
-       printer->untiltime = ntprinter.info_2->untiltime;                       /* untiltime */
-       printer->status = status.status;                                        /* status */
+       init_unistr(&printer->location, ntprinter->info_2->location);           /* location */  
+       init_unistr(&printer->sepfile, ntprinter->info_2->sepfile);             /* separator file */
+       init_unistr(&printer->printprocessor, ntprinter->info_2->printprocessor);/* print processor */
+       init_unistr(&printer->datatype, ntprinter->info_2->datatype);           /* datatype */  
+       init_unistr(&printer->parameters, ntprinter->info_2->parameters);       /* parameters (of print processor) */   
+
+       printer->attributes = ntprinter->info_2->attributes;
+
+       printer->priority = ntprinter->info_2->priority;                                /* priority */  
+       printer->defaultpriority = ntprinter->info_2->default_priority;         /* default priority */
+       printer->starttime = ntprinter->info_2->starttime;                      /* starttime */
+       printer->untiltime = ntprinter->info_2->untiltime;                      /* untiltime */
+       printer->status = nt_printq_status(status.status);                      /* status */
        printer->cjobs = count;                                                 /* jobs */
-       printer->averageppm = ntprinter.info_2->averageppm;                     /* average pages per minute */
+       printer->averageppm = ntprinter->info_2->averageppm;                    /* average pages per minute */
                        
-       devmode=(DEVICEMODE *)malloc(sizeof(DEVICEMODE));
-       ZERO_STRUCTP(devmode);  
-       construct_dev_mode(devmode, snum, servername);                  
-       printer->devmode=devmode;
-       
+       if((printer->devmode = construct_dev_mode(snum, servername)) == NULL)
+               goto err;
+
+       if (ntprinter->info_2->secdesc_buf->len != 0) {
+               /* steal the printer info sec_desc structure.  [badly done]. */
+               printer->secdesc = ntprinter->info_2->secdesc_buf->sec;
+               ntprinter->info_2->secdesc_buf->sec = NULL; /* Stolen memory. */
+               ntprinter->info_2->secdesc_buf->len = 0; /* Stolen memory. */
+               ntprinter->info_2->secdesc_buf->max_len = 0; /* Stolen memory. */
+       }
+       else {
+               printer->secdesc = NULL;
+       }
+
+       free_a_printer(&ntprinter, 2);
        safe_free(queue);
-       free_a_printer(ntprinter, 2);
+       return True;
+
+  err:
+
+       if (ntprinter)
+               free_a_printer(&ntprinter, 2);
+       safe_free(queue);
+       return False;
+}
+
+/********************************************************************
+ * construct_printer_info_3
+ * fill a printer_info_3 struct
+ ********************************************************************/
+static BOOL construct_printer_info_3(fstring servername,
+                       PRINTER_INFO_3 **pp_printer, int snum)
+{
+       NT_PRINTER_INFO_LEVEL *ntprinter = NULL;
+       PRINTER_INFO_3 *printer = NULL;
+
+       if (get_a_printer(&ntprinter, 2, lp_servicename(snum)) !=0 )
+               return False;
+
+       *pp_printer = NULL;
+       if ((printer = (PRINTER_INFO_3 *)malloc(sizeof(PRINTER_INFO_3))) == NULL) {
+               DEBUG(0,("construct_printer_info_3: malloc fail.\n"));
+               return False;
+       }
+
+       ZERO_STRUCTP(printer);
+       
+       printer->flags = 4; /* This is the offset to the SEC_DESC. */
+       if (ntprinter->info_2->secdesc_buf->len != 0) {
+               /* steal the printer info sec_desc structure.  [badly done]. */
+               printer->secdesc = ntprinter->info_2->secdesc_buf->sec;
+               ntprinter->info_2->secdesc_buf->sec = NULL; /* Stolen the malloced memory. */
+               ntprinter->info_2->secdesc_buf->len = 0; /* Stolen the malloced memory. */
+               ntprinter->info_2->secdesc_buf->max_len = 0; /* Stolen the malloced memory. */
+       }
+
+       free_a_printer(&ntprinter, 2);
+
+       *pp_printer = printer;
        return True;
 }
 
@@ -1771,7 +2007,10 @@ static BOOL enum_all_printers_info_1(fstring server, uint32 flags, NEW_BUFFER *b
                        DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
                                
                        if (construct_printer_info_1(server, flags, &current_prt, snum)) {
-                               printers=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_1));
+                               if((printers=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_1))) == NULL) {
+                                       *returned=0;
+                                       return ERROR_NOT_ENOUGH_MEMORY;
+                               }
                                DEBUG(4,("ReAlloced memory for [%d] PRINTER_INFO_1\n", *returned));             
                                memcpy(&(printers[*returned]), &current_prt, sizeof(PRINTER_INFO_1));
                                (*returned)++;
@@ -1857,7 +2096,8 @@ static BOOL enum_all_printers_info_1_remote(fstring name, NEW_BUFFER *buffer, ui
         * We should have a TDB here. The registration is done thru an undocumented RPC call.
         */
        
-       printer=(PRINTER_INFO_1 *)malloc(sizeof(PRINTER_INFO_1));
+       if((printer=(PRINTER_INFO_1 *)malloc(sizeof(PRINTER_INFO_1))) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
 
        *returned=1;
        
@@ -1924,7 +2164,8 @@ static BOOL enum_all_printers_info_2(fstring servername, NEW_BUFFER *buffer, uin
                        DEBUG(4,("Found a printer in smb.conf: %s[%x]\n", lp_servicename(snum), snum));
                                
                        if (construct_printer_info_2(servername, &current_prt, snum)) {
-                               printers=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_2));
+                               if((printers=Realloc(printers, (*returned +1)*sizeof(PRINTER_INFO_2))) == NULL)
+                                       return ERROR_NOT_ENOUGH_MEMORY;
                                DEBUG(4,("ReAlloced memory for [%d] PRINTER_INFO_2\n", *returned));             
                                memcpy(&(printers[*returned]), &current_prt, sizeof(PRINTER_INFO_2));
                                (*returned)++;
@@ -1934,16 +2175,26 @@ static BOOL enum_all_printers_info_2(fstring servername, NEW_BUFFER *buffer, uin
        
        /* check the required size. */  
        for (i=0; i<*returned; i++)
-               (*needed) += spoolss_size_printer_info_2(&(printers[i]));
+               (*needed) += spoolss_size_printer_info_2(&printers[i]);
 
-       if (!alloc_buffer_size(buffer, *needed))
+       if (!alloc_buffer_size(buffer, *needed)) {
+               for (i=0; i<*returned; i++) {
+                       free_devmode(printers[i].devmode);
+                       free_sec_desc(&printers[i].secdesc);
+               }
+               safe_free(printers);
                return ERROR_INSUFFICIENT_BUFFER;
+       }
 
        /* fill the buffer with the structures */
        for (i=0; i<*returned; i++)
                new_smb_io_printer_info_2("", buffer, &(printers[i]), 0);       
        
        /* clear memory */
+       for (i=0; i<*returned; i++) {
+               free_devmode(printers[i].devmode);
+               free_sec_desc(&printers[i].secdesc);
+       }
        safe_free(printers);
 
        if (*needed > offered) {
@@ -2066,18 +2317,19 @@ uint32 _spoolss_enumprinters( uint32 flags, const UNISTR2 *servername, uint32 le
        case 3:
        case 4:
        default:
-               return NT_STATUS_INVALID_LEVEL;
+               return ERROR_INVALID_LEVEL;
                break;
        }
 }
 
 /****************************************************************************
 ****************************************************************************/
-static uint32 getprinter_level_0(pstring servername, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
+static uint32 getprinter_level_0(fstring servername, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        PRINTER_INFO_0 *printer=NULL;
 
-       printer=(PRINTER_INFO_0*)malloc(sizeof(PRINTER_INFO_0));
+       if((printer=(PRINTER_INFO_0*)malloc(sizeof(PRINTER_INFO_0))) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
 
        construct_printer_info_0(printer, snum, servername);
        
@@ -2104,11 +2356,13 @@ static uint32 getprinter_level_0(pstring servername, int snum, NEW_BUFFER *buffe
 
 /****************************************************************************
 ****************************************************************************/
-static uint32 getprinter_level_1(pstring servername, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
+static uint32 getprinter_level_1(fstring servername, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        PRINTER_INFO_1 *printer=NULL;
 
-       printer=(PRINTER_INFO_1*)malloc(sizeof(PRINTER_INFO_1));
+       if((printer=(PRINTER_INFO_1*)malloc(sizeof(PRINTER_INFO_1))) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
+
        construct_printer_info_1(servername, PRINTER_ENUM_ICON8, printer, snum);
        
        /* check the required size. */  
@@ -2134,12 +2388,13 @@ static uint32 getprinter_level_1(pstring servername, int snum, NEW_BUFFER *buffe
 
 /****************************************************************************
 ****************************************************************************/
-static uint32 getprinter_level_2(pstring servername, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
+static uint32 getprinter_level_2(fstring servername, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        PRINTER_INFO_2 *printer=NULL;
        fstring temp;
 
-       printer=(PRINTER_INFO_2*)malloc(sizeof(PRINTER_INFO_2));
+       if((printer=(PRINTER_INFO_2*)malloc(sizeof(PRINTER_INFO_2)))==NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
        
        fstrcpy(temp, "\\\\");
        fstrcat(temp, servername);
@@ -2149,16 +2404,52 @@ static uint32 getprinter_level_2(pstring servername, int snum, NEW_BUFFER *buffe
        *needed += spoolss_size_printer_info_2(printer);
 
        if (!alloc_buffer_size(buffer, *needed)) {
-               safe_free(printer);
+               free_printer_info_2(printer);
                return ERROR_INSUFFICIENT_BUFFER;
        }
 
        /* fill the buffer with the structures */
-       new_smb_io_printer_info_2("", buffer, printer, 0);      
+       if (!new_smb_io_printer_info_2("", buffer, printer, 0)) {
+               free_printer_info_2(printer);
+               return ERROR_NOT_ENOUGH_MEMORY;
+       }
        
        /* clear memory */
-       safe_free(printer);
+       free_printer_info_2(printer);
+
+       if (*needed > offered) {
+               return ERROR_INSUFFICIENT_BUFFER;
+       }
+       else
+               return NT_STATUS_NO_PROBLEMO;   
+}
+
+/****************************************************************************
+****************************************************************************/
+static uint32 getprinter_level_3(fstring servername, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
+{
+       PRINTER_INFO_3 *printer=NULL;
+       fstring temp;
+
+       fstrcpy(temp, "\\\\");
+       fstrcat(temp, servername);
+       if (!construct_printer_info_3(temp, &printer, snum))
+               return ERROR_NOT_ENOUGH_MEMORY;
+       
+       /* check the required size. */  
+       *needed += spoolss_size_printer_info_3(printer);
+
+       if (!alloc_buffer_size(buffer, *needed)) {
+               free_printer_info_3(printer);
+               return ERROR_INSUFFICIENT_BUFFER;
+       }
 
+       /* fill the buffer with the structures */
+       new_smb_io_printer_info_3("", buffer, printer, 0);      
+       
+       /* clear memory */
+       free_printer_info_3(printer);
+       
        if (*needed > offered) {
                return ERROR_INSUFFICIENT_BUFFER;
        }
@@ -2172,25 +2463,24 @@ uint32 _spoolss_getprinter(POLICY_HND *handle, uint32 level,
                           NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        int snum;
-       pstring servername;
+       fstring servername;
        
        *needed=0;
 
        pstrcpy(servername, global_myname);
 
        if (!get_printer_snum(handle, &snum))
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
 
        switch (level) {
        case 0:
                return getprinter_level_0(servername, snum, buffer, offered, needed);
-               break;
        case 1:
                return getprinter_level_1(servername,snum, buffer, offered, needed);
-               break;
        case 2:         
                return getprinter_level_2(servername,snum, buffer, offered, needed);
-               break;
+       case 3:         
+               return getprinter_level_3(servername,snum, buffer, offered, needed);
        default:
                return ERROR_INVALID_LEVEL;
                break;
@@ -2203,24 +2493,25 @@ uint32 _spoolss_getprinter(POLICY_HND *handle, uint32 level,
  ********************************************************************/
 static void fill_printer_driver_info_1(DRIVER_INFO_1 *info, 
                                        NT_PRINTER_DRIVER_INFO_LEVEL driver, 
-                                      pstring servername, fstring architecture)
+                                      fstring servername, fstring architecture)
 {
        init_unistr( &(info->name), driver.info_3->name);
 }
 
 static void construct_printer_driver_info_1(DRIVER_INFO_1 *info, int snum, 
-                                            pstring servername, fstring architecture)
+                                            fstring servername, fstring architecture)
 {      
-       NT_PRINTER_INFO_LEVEL printer;
+       NT_PRINTER_INFO_LEVEL *printer = NULL;
        NT_PRINTER_DRIVER_INFO_LEVEL driver;
 
+       ZERO_STRUCT(driver);
+
        get_a_printer(&printer, 2, lp_servicename(snum) );
-       get_a_printer_driver(&driver, 3, printer.info_2->drivername, architecture);     
+       get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture);    
        
        fill_printer_driver_info_1(info, driver, servername, architecture);
-       
-       free_a_printer_driver(driver, 3);
-       free_a_printer(printer, 2);
+
+       free_a_printer(&printer,2);
 }
 
 /********************************************************************
@@ -2229,7 +2520,7 @@ static void construct_printer_driver_info_1(DRIVER_INFO_1 *info, int snum,
  ********************************************************************/
 static void fill_printer_driver_info_2(DRIVER_INFO_2 *info, 
                                        NT_PRINTER_DRIVER_INFO_LEVEL driver, 
-                                      pstring servername, fstring architecture)
+                                      fstring servername, fstring architecture)
 {
        pstring where;
        pstring temp_driverpath;
@@ -2239,7 +2530,7 @@ static void fill_printer_driver_info_2(DRIVER_INFO_2 *info,
 
        get_short_archi(short_archi,architecture);
        
-       snprintf(where,sizeof(where)-1,"\\\\%s\\print$\\%s\\", servername, short_archi);
+       snprintf(where,sizeof(where)-1,"\\\\%s\\print$\\%s\\%s\\", servername, short_archi, driver.info_3->name);
 
        info->version=driver.info_3->cversion;
 
@@ -2263,53 +2554,60 @@ static void fill_printer_driver_info_2(DRIVER_INFO_2 *info,
  * construct_printer_driver_info_2
  * fill a printer_info_2 struct
  ********************************************************************/
-static void construct_printer_driver_info_2(DRIVER_INFO_2 *info, int snum, 
-                                            pstring servername, fstring architecture)
+static void construct_printer_driver_info_2(DRIVER_INFO_2 *info, int snum, fstring servername, fstring architecture)
 {
-       NT_PRINTER_INFO_LEVEL printer;
+       NT_PRINTER_INFO_LEVEL *printer = NULL;
        NT_PRINTER_DRIVER_INFO_LEVEL driver;
-       
+
+       ZERO_STRUCT(printer);
+       ZERO_STRUCT(driver);
+
        get_a_printer(&printer, 2, lp_servicename(snum) );
-       get_a_printer_driver(&driver, 3, printer.info_2->drivername, architecture);     
+       get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture);    
 
        fill_printer_driver_info_2(info, driver, servername, architecture);
 
-       free_a_printer_driver(driver, 3);
-       free_a_printer(printer, 2);
+       free_a_printer(&printer,2);
 }
 
 /********************************************************************
  * copy a strings array and convert to UNICODE
+ *
+ * convert an array of ascii string to a UNICODE string
  ********************************************************************/
-static void init_unistr_array(UNISTR ***uni_array, char **char_array, char *where)
+static void init_unistr_array(uint16 **uni_array, fstring *char_array, char *where)
 {
        int i=0;
+       int j=0;
        char *v;
        pstring line;
 
        DEBUG(6,("init_unistr_array\n"));
-
-       for (v=char_array[i]; *v!='\0'; v=char_array[i])
-       {
-               DEBUGADD(6,("i:%d:", i));
-               DEBUGADD(6,("%s:%d:", v, strlen(v)));
-       
-               *uni_array=(UNISTR **)Realloc(*uni_array, sizeof(UNISTR *)*(i+1));
-               DEBUGADD(7,("realloc:[%p],", *uni_array));
-                       
-               (*uni_array)[i]=(UNISTR *)malloc( sizeof(UNISTR) );
-               DEBUGADD(7,("alloc:[%p],", (*uni_array)[i]));
-
+       *uni_array=NULL;
+
+       while (1) {
+               if (char_array == NULL)
+                       v = "";
+               else {
+                       v = char_array[i];
+                       if (!v) v = ""; /* hack to handle null lists */
+               }
                snprintf(line, sizeof(line)-1, "%s%s", where, v);
-               init_unistr( (*uni_array)[i], line );
-               DEBUGADD(7,("copy\n"));
-                       
+               DEBUGADD(6,("%d:%s:%d\n", i, line, strlen(line)));
+               if((*uni_array=Realloc(*uni_array, (j+strlen(line)+2)*sizeof(uint16))) == NULL) {
+                       DEBUG(0,("init_unistr_array: Realloc error\n" ));
+                       return;
+               }
+               ascii_to_unistr((char *)(*uni_array+j), line , 2*strlen(line));
+               j+=strlen(line)+1;                      
                i++;
+               if (strlen(v) == 0) break;
+       }
+       
+       if (*uni_array) {
+               (*uni_array)[j]=0x0000;
        }
-       DEBUGADD(7,("last one\n"));
        
-       *uni_array=(UNISTR **)Realloc(*uni_array, sizeof(UNISTR *)*(i+1));
-       (*uni_array)[i]=0x0000;
        DEBUGADD(6,("last one:done\n"));
 }
 
@@ -2319,7 +2617,7 @@ static void init_unistr_array(UNISTR ***uni_array, char **char_array, char *wher
  ********************************************************************/
 static void fill_printer_driver_info_3(DRIVER_INFO_3 *info, 
                                        NT_PRINTER_DRIVER_INFO_LEVEL driver, 
-                                      pstring servername, fstring architecture)
+                                      fstring servername, fstring architecture)
 {
        pstring where;
        pstring temp_driverpath;
@@ -2330,8 +2628,8 @@ static void fill_printer_driver_info_3(DRIVER_INFO_3 *info,
        
        get_short_archi(short_archi, architecture);
        
-       snprintf(where,sizeof(where)-1,"\\\\%s\\print$\\%s\\", servername, short_archi);
-       
+       snprintf(where,sizeof(where)-1,"\\\\%s\\print$\\%s\\%s\\", servername, short_archi, driver.info_3->name);
+
        info->version=driver.info_3->cversion;
 
        init_unistr( &(info->name),         driver.info_3->name );      
@@ -2349,11 +2647,11 @@ static void fill_printer_driver_info_3(DRIVER_INFO_3 *info,
        snprintf(temp_helpfile,   sizeof(temp_helpfile)-1,   "%s%s", where, driver.info_3->helpfile);
        init_unistr( &(info->helpfile), temp_helpfile );
 
-       init_unistr( &(info->monitorname), driver.info_3->monitorname );        
+       init_unistr( &(info->monitorname), driver.info_3->monitorname );
        init_unistr( &(info->defaultdatatype), driver.info_3->defaultdatatype );
 
        info->dependentfiles=NULL;
-       init_unistr_array(&(info->dependentfiles), driver.info_3->dependentfiles, where);
+       init_unistr_array(&info->dependentfiles, driver.info_3->dependentfiles, where);
 }
 
 /********************************************************************
@@ -2361,27 +2659,37 @@ static void fill_printer_driver_info_3(DRIVER_INFO_3 *info,
  * fill a printer_info_3 struct
  ********************************************************************/
 static void construct_printer_driver_info_3(DRIVER_INFO_3 *info, int snum, 
-                                            pstring servername, fstring architecture)
+                                            fstring servername, fstring architecture)
 {      
-       NT_PRINTER_INFO_LEVEL printer;
+       NT_PRINTER_INFO_LEVEL *printer = NULL;
        NT_PRINTER_DRIVER_INFO_LEVEL driver;
-       
+
+       ZERO_STRUCT(driver);
+
        get_a_printer(&printer, 2, lp_servicename(snum) );      
-       get_a_printer_driver(&driver, 3, printer.info_2->drivername, architecture);     
+       get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture);    
 
        fill_printer_driver_info_3(info, driver, servername, architecture);
 
-       free_a_printer_driver(driver, 3);
-       free_a_printer(printer, 2);
+       free_a_printer(&printer,2);
 }
 
 /****************************************************************************
 ****************************************************************************/
-static uint32 getprinterdriver2_level1(pstring servername, pstring architecture, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
+
+static void free_printer_driver_info_3(DRIVER_INFO_3 *info)
+{
+       safe_free(info->dependentfiles);
+}
+
+/****************************************************************************
+****************************************************************************/
+static uint32 getprinterdriver2_level1(fstring servername, fstring architecture, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        DRIVER_INFO_1 *info=NULL;
        
-       info=(DRIVER_INFO_1 *)malloc(sizeof(DRIVER_INFO_1));
+       if((info=(DRIVER_INFO_1 *)malloc(sizeof(DRIVER_INFO_1))) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
        
        construct_printer_driver_info_1(info, snum, servername, architecture);
 
@@ -2407,11 +2715,12 @@ static uint32 getprinterdriver2_level1(pstring servername, pstring architecture,
 
 /****************************************************************************
 ****************************************************************************/
-static uint32 getprinterdriver2_level2(pstring servername, pstring architecture, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
+static uint32 getprinterdriver2_level2(fstring servername, fstring architecture, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        DRIVER_INFO_2 *info=NULL;
        
-       info=(DRIVER_INFO_2 *)malloc(sizeof(DRIVER_INFO_2));
+       if((info=(DRIVER_INFO_2 *)malloc(sizeof(DRIVER_INFO_2))) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
        
        construct_printer_driver_info_2(info, snum, servername, architecture);
 
@@ -2437,27 +2746,26 @@ static uint32 getprinterdriver2_level2(pstring servername, pstring architecture,
 
 /****************************************************************************
 ****************************************************************************/
-static uint32 getprinterdriver2_level3(pstring servername, pstring architecture, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
+static uint32 getprinterdriver2_level3(fstring servername, fstring architecture, int snum, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
-       DRIVER_INFO_3 *info=NULL;
-       
-       info=(DRIVER_INFO_3 *)malloc(sizeof(DRIVER_INFO_3));
-       
-       construct_printer_driver_info_3(info, snum, servername, architecture);
+       DRIVER_INFO_3 info;
+
+       ZERO_STRUCT(info);
+
+       construct_printer_driver_info_3(&info, snum, servername, architecture);
 
        /* check the required size. */  
-       *needed += spoolss_size_printer_driver_info_3(info);
+       *needed += spoolss_size_printer_driver_info_3(&info);
 
        if (!alloc_buffer_size(buffer, *needed)) {
-               safe_free(info);
+               free_printer_driver_info_3(&info);
                return ERROR_INSUFFICIENT_BUFFER;
        }
 
        /* fill the buffer with the structures */
-       new_smb_io_printer_driver_info_3("", buffer, info, 0);  
+       new_smb_io_printer_driver_info_3("", buffer, &info, 0);
 
-       /* clear memory */
-       safe_free(info);
+       free_printer_driver_info_3(&info);
 
        if (*needed > offered)
                return ERROR_INSUFFICIENT_BUFFER;
@@ -2472,7 +2780,7 @@ uint32 _spoolss_getprinterdriver2(const POLICY_HND *handle, const UNISTR2 *uni_a
                                NEW_BUFFER *buffer, uint32 offered,
                                uint32 *needed, uint32 *servermajorversion, uint32 *serverminorversion)
 {
-       pstring servername;
+       fstring servername;
        fstring architecture;
        int snum;
 
@@ -2486,7 +2794,7 @@ uint32 _spoolss_getprinterdriver2(const POLICY_HND *handle, const UNISTR2 *uni_a
        unistr2_to_ascii(architecture, uni_arch, sizeof(architecture)-1);
 
        if (!get_printer_snum(handle, &snum))
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
 
        switch (level) {
        case 1:
@@ -2499,7 +2807,7 @@ uint32 _spoolss_getprinterdriver2(const POLICY_HND *handle, const UNISTR2 *uni_a
                return getprinterdriver2_level3(servername, architecture, snum, buffer, offered, needed);
                break;                          
        default:
-               return NT_STATUS_INVALID_LEVEL;
+               return ERROR_INVALID_LEVEL;
                break;
        }
 }
@@ -2517,7 +2825,7 @@ uint32 _spoolss_startpageprinter(const POLICY_HND *handle)
        }
 
        DEBUG(3,("Error in startpageprinter printer handle\n"));
-       return NT_STATUS_INVALID_HANDLE;
+       return ERROR_INVALID_HANDLE;
 }
 
 /****************************************************************************
@@ -2529,7 +2837,7 @@ uint32 _spoolss_endpageprinter(const POLICY_HND *handle)
        if (!OPEN_HANDLE(Printer))
        {
                DEBUG(3,("Error in endpageprinter printer handle\n"));
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
        }
        
        Printer->page_started=False;
@@ -2547,17 +2855,14 @@ uint32 _spoolss_startdocprinter( const POLICY_HND *handle, uint32 level,
                                DOC_INFO *docinfo, uint32 *jobid)
 {
        DOC_INFO_1 *info_1 = &docinfo->doc_info_1;
-       
-       pstring fname;
-       pstring tempname;
-       pstring datatype;
-       int fd = -1;
        int snum;
+       pstring jobname;
+       fstring datatype;
        Printer_entry *Printer = find_printer_index_by_hnd(handle);
 
        if (!OPEN_HANDLE(Printer))
        {
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
        }
 
        /*
@@ -2585,27 +2890,21 @@ uint32 _spoolss_startdocprinter( const POLICY_HND *handle, uint32 level,
        /* get the share number of the printer */
        if (!get_printer_snum(handle, &snum))
        {
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
        }
 
-       /* Create a temporary file in the printer spool directory
-        * and open it
-        */
-
-       slprintf(tempname,sizeof(tempname)-1, "%s/smb_print.XXXXXX",lp_pathname(snum));  
-       pstrcpy(fname, (char *)mktemp(tempname));
-
-       fd=open(fname, O_WRONLY|O_CREAT|O_TRUNC|O_EXCL, S_IRUSR|S_IWUSR );
-       DEBUG(4,("Temp spool file created: [%s]\n", fname));
-
-       Printer->current_jobid=fd;
-       pstrcpy(Printer->document_name, fname);
+       unistr2_to_ascii(jobname, &info_1->docname, sizeof(jobname));
        
-       unistr2_to_ascii(Printer->job_name, &info_1->docname, sizeof(Printer->job_name));
+       Printer->jobid = print_job_start(snum, jobname);
+
+       /* need to map error codes properly - for now give out of
+          memory as I don't know the correct codes (tridge) */
+       if (Printer->jobid == -1) {
+               return ERROR_NOT_ENOUGH_MEMORY;
+       }
        
-       Printer->document_fd=fd;
        Printer->document_started=True;
-       (*jobid) = Printer->current_jobid;
+       (*jobid) = Printer->jobid;
 
        return 0x0;
 }
@@ -2617,86 +2916,17 @@ uint32 _spoolss_startdocprinter( const POLICY_HND *handle, uint32 level,
  ********************************************************************/
 uint32 _spoolss_enddocprinter(const POLICY_HND *handle)
 {
-       int snum;
-       pstring filename;
-       pstring filename1;
-       pstring job_name;
-       pstring syscmd;
-       char *tstr;
        Printer_entry *Printer=find_printer_index_by_hnd(handle);
        
-       *syscmd=0;
-       
        if (!OPEN_HANDLE(Printer))
        {
                DEBUG(3,("Error in enddocprinter handle\n"));
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
        }
        
        Printer->document_started=False;
-       close(Printer->document_fd);
-       DEBUG(4,("Temp spool file closed, printing now ...\n"));
-
-       pstrcpy(filename1, Printer->document_name);
-       pstrcpy(job_name, Printer->job_name);
-       
-       if (!get_printer_snum(handle,&snum))
-       {
-               return NT_STATUS_INVALID_HANDLE;
-       }
-       
-       /* copy the command into the buffer for extensive meddling. */
-       StrnCpy(syscmd, lp_printcommand(snum), sizeof(pstring) - 1);
-
-       /* look for "%s" in the string. If there is no %s, we cannot print. */   
-       if (!strstr(syscmd, "%s") && !strstr(syscmd, "%f"))
-       {
-               DEBUG(2,("WARNING! No placeholder for the filename in the print command for service %s!\n", SERVICE(snum)));
-       }
-
-       if (strstr(syscmd,"%s"))
-       {
-               pstrcpy(filename,filename1);
-               pstring_sub(syscmd, "%s", filename);
-       }
-
-       pstring_sub(syscmd, "%f", filename1);
-
-       /* Does the service have a printername? If not, make a fake and empty
-        * printer name. That way a %p is treated sanely if no printer
-        * name was specified to replace it. This eventuality is logged.
-        */
-
-       tstr = lp_printername(snum);
-       if (tstr == NULL || tstr[0] == '\0')
-       {
-               DEBUG(3,( "No printer name - using %s.\n", SERVICE(snum)));
-               tstr = SERVICE(snum);
-       }
-
-       pstring_sub(syscmd, "%p", tstr);
-
-       /* If the lpr command support the 'Job' option replace here */
-       pstring_sub(syscmd, "%j", job_name);
-
-       if ( *syscmd != '\0')
-       {
-         int ret = smbrun(syscmd, NULL, False);
-         DEBUG(3,("Running the command `%s' gave %d\n", syscmd, ret));
-         if (ret < 0)
-               {
-                       lpq_reset(snum);
-                       return NT_STATUS_ACCESS_DENIED;
-               }
-       }
-       else
-               {
-         DEBUG(0,("Null print command?\n"));
-                       lpq_reset(snum);
-                       return NT_STATUS_ACCESS_DENIED;
-               }
-
-       lpq_reset(snum);
+       print_job_end(Printer->jobid);
+       /* error codes unhandled so far ... */
 
        return 0x0;
 }
@@ -2708,18 +2938,15 @@ uint32 _spoolss_writeprinter( const POLICY_HND *handle,
                                const uint8 *buffer,
                                uint32 *buffer_written)
 {
-       int fd;
        Printer_entry *Printer = find_printer_index_by_hnd(handle);
        
        if (!OPEN_HANDLE(Printer))
        {
                DEBUG(3,("Error in writeprinter handle\n"));
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
        }
 
-       fd = Printer->document_fd;
-       (*buffer_written) = write(fd, buffer, buffer_size);
-       Printer->document_lastwritten = (*buffer_written);
+       (*buffer_written) = print_job_write(Printer->jobid, buffer, buffer_size);
 
        return 0x0;
 }
@@ -2735,102 +2962,108 @@ static uint32 control_printer(const POLICY_HND *handle, uint32 command)
        Printer_entry *Printer = find_printer_index_by_hnd(handle);
 
        if (!OPEN_HANDLE(Printer))
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
 
        if (!get_printer_snum(handle, &snum) )   
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
 
        switch (command) {
-               case PRINTER_CONTROL_PAUSE:
-                       /* pause the printer here */
-                       status_printqueue(NULL, snum, LPSTAT_STOPPED);
-                       return 0x0;
-                       break;
-               case PRINTER_CONTROL_RESUME:
-               case PRINTER_CONTROL_UNPAUSE:
-                       /* UN-pause the printer here */
-                       status_printqueue(NULL, snum, LPSTAT_OK);
-                       return 0x0;
-                       break;
-               case PRINTER_CONTROL_PURGE:
-                       /*
-                        * It's not handled by samba
-                        * we need a smb.conf param to do
-                        * lprm -P%p - on BSD
-                        * lprm -P%p all on LPRNG
-                        * I don't know on SysV
-                        * we could do it by looping in the job's list...
-                        */
-                       break;
+       case PRINTER_CONTROL_PAUSE:
+               if (print_queue_pause(snum)) {
+                       return 0;
+               }
+               break;
+       case PRINTER_CONTROL_RESUME:
+       case PRINTER_CONTROL_UNPAUSE:
+               if (print_queue_resume(snum)) {
+                       return 0;
+               }
+               break;
+       case PRINTER_CONTROL_PURGE:
+               if (print_queue_purge(snum)) {
+                       return 0;
+               }
+               break;
        }
 
-       return NT_STATUS_INVALID_INFO_CLASS;
+       return ERROR_INVALID_FUNCTION;
 }
 
 /********************************************************************
  * called by spoolss_api_setprinter
  * when updating a printer description
  ********************************************************************/
+static uint32 update_printer_sec(const POLICY_HND *handle, uint32 level,
+                                const SPOOL_PRINTER_INFO_LEVEL *info,
+                                SEC_DESC_BUF *secdesc_ctr)
+{
+       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+
+       if (!OPEN_HANDLE(Printer))
+               return ERROR_INVALID_HANDLE;
+
+       return nt_printing_setsec(Printer->dev.printername, secdesc_ctr);
+}
+
+/********************************************************************
+ * called by spoolss_api_setprinter
+ * when updating a printer description
+ ********************************************************************/
+
 static uint32 update_printer(const POLICY_HND *handle, uint32 level,
                            const SPOOL_PRINTER_INFO_LEVEL *info,
-                           const DEVICEMODE *devmode)
+                           DEVICEMODE *devmode)
 {
        int snum;
-       NT_PRINTER_INFO_LEVEL printer;
-       NT_DEVICEMODE *nt_devmode;
+       NT_PRINTER_INFO_LEVEL *printer = NULL;
        Printer_entry *Printer = find_printer_index_by_hnd(handle);
-
-       nt_devmode=NULL;
        
        DEBUG(8,("update_printer\n"));
        
        if (level!=2) {
-               DEBUG(0,("Send a mail to jfm@samba.org\n"));
+               DEBUG(0,("Send a mail to samba@samba.org\n"));
                DEBUGADD(0,("with the following message: update_printer: level!=2\n"));
-               return NT_STATUS_INVALID_INFO_CLASS;
+               return ERROR_INVALID_LEVEL;
        }
 
        if (!OPEN_HANDLE(Printer))
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
 
        if (!get_printer_snum(handle, &snum) )
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
        
        get_a_printer(&printer, 2, lp_servicename(snum));
 
        DEBUGADD(8,("Converting info_2 struct\n"));
-       convert_printer_info(info, &printer, level);
+       convert_printer_info(info, printer, level);
        
-       if ((info->info_2)->devmode_ptr != 0) {
+       if (info->info_2->devmode_ptr != 0) {
+               NT_DEVICEMODE *ntdevmode = NULL;
                /* we have a valid devmode
                   convert it and link it*/
                
-               /* the nt_devmode memory is already alloced
-                * while doing the get_a_printer call
-                * but the devmode private part is not
-                * it's done by convert_devicemode
-                */
                DEBUGADD(8,("Converting the devicemode struct\n"));
-               nt_devmode=printer.info_2->devmode;
-               
-               init_devicemode(nt_devmode);
+               if (printer->info_2->devmode) {
+                       ntdevmode = dup_nt_devicemode(printer->info_2->devmode);
+               } else {
+                       ntdevmode = construct_nt_devicemode();
+               }
                                
-               convert_devicemode(*devmode, nt_devmode);
-       }
-       else {
-               if (printer.info_2->devmode != NULL)
-                       free(printer.info_2->devmode);
-               printer.info_2->devmode=NULL;
+               convert_devicemode(devmode, ntdevmode);
+               free_nt_devicemode(&ntdevmode);
+       else {
+               if (printer->info_2->devmode != NULL)
+                       free_nt_devicemode(&printer->info_2->devmode);
+               printer->info_2->devmode=NULL;
        }
                        
-       if (add_a_printer(printer, 2)!=0) {
-               free_a_printer(printer, 2);
-               
+       if (add_a_printer(*printer, 2)!=0) {
                /* I don't really know what to return here !!! */
-               return NT_STATUS_INVALID_INFO_CLASS;
+               free_a_printer(&printer, 2);
+               return ERROR_ACCESS_DENIED;
        }
 
-       free_a_printer(printer, 2);
+       free_a_printer(&printer, 2);
 
        return NT_STATUS_NO_PROBLEMO;
 }
@@ -2839,13 +3072,14 @@ static uint32 update_printer(const POLICY_HND *handle, uint32 level,
 ****************************************************************************/
 uint32 _spoolss_setprinter(const POLICY_HND *handle, uint32 level,
                           const SPOOL_PRINTER_INFO_LEVEL *info,
-                          const DEVMODE_CTR devmode_ctr,
+                          DEVMODE_CTR devmode_ctr,
+                          SEC_DESC_BUF *secdesc_ctr,
                           uint32 command)
 {
        Printer_entry *Printer = find_printer_index_by_hnd(handle);
        
        if (!OPEN_HANDLE(Printer))
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
 
        /* check the level */   
        switch (level) {
@@ -2855,6 +3089,9 @@ uint32 _spoolss_setprinter(const POLICY_HND *handle, uint32 level,
                case 2:
                        return update_printer(handle, level, info, devmode_ctr.devmode);
                        break;
+               case 3:
+                       return update_printer_sec(handle, level, info, secdesc_ctr);
+                       break;
                default:
                        return ERROR_INVALID_LEVEL;
                        break;
@@ -2868,12 +3105,14 @@ uint32 _spoolss_fcpn(const POLICY_HND *handle)
        Printer_entry *Printer= find_printer_index_by_hnd(handle);
        
        if (!OPEN_HANDLE(Printer))
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
        
        Printer->notify.flags=0;
        Printer->notify.options=0;
        Printer->notify.localmachine[0]='\0';
        Printer->notify.printerlocal=0;
+       if (Printer->notify.option)
+               safe_free(Printer->notify.option->ctr.type);
        safe_free(Printer->notify.option);
        Printer->notify.option=NULL;
        
@@ -2908,7 +3147,7 @@ static void fill_job_info_1(JOB_INFO_1 *job_info, print_queue_struct *queue,
        init_unistr(&(job_info->document), queue->file);
        init_unistr(&(job_info->datatype), "RAW");
        init_unistr(&(job_info->text_status), "");
-       job_info->status=queue->status;
+       job_info->status=nt_printj_status(queue->status);
        job_info->priority=queue->priority;
        job_info->position=position;
        job_info->totalpages=0;
@@ -2924,23 +3163,22 @@ static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue,
 {
        pstring temp_name;
        DEVICEMODE *devmode;
-       NT_PRINTER_INFO_LEVEL ntprinter;
+       NT_PRINTER_INFO_LEVEL *ntprinter = NULL;
        pstring chaine;
 
        struct tm *t;
        time_t unixdate = time(NULL);
 
        if (get_a_printer(&ntprinter, 2, lp_servicename(snum)) !=0 )
-       {
-               return (False);
-       }       
+               return False;
        
        t=gmtime(&unixdate);
        snprintf(temp_name, sizeof(temp_name), "\\\\%s", global_myname);
 
        job_info->jobid=queue->job;
        
-       snprintf(chaine, sizeof(chaine)-1, "\\\\%s\\%s", global_myname, ntprinter.info_2->printername);
+       snprintf(chaine, sizeof(chaine)-1, "\\\\%s\\%s", global_myname, ntprinter->info_2->printername);
+
        init_unistr(&(job_info->printername), chaine);
        
        init_unistr(&(job_info->machinename), temp_name);
@@ -2954,7 +3192,7 @@ static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue,
        
 /* and here the security descriptor */
 
-       job_info->status=queue->status;
+       job_info->status=nt_printj_status(queue->status);
        job_info->priority=queue->priority;
        job_info->position=position;
        job_info->starttime=0;
@@ -2965,12 +3203,13 @@ static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue,
        job_info->timeelapsed=0;
        job_info->pagesprinted=0;
 
-       devmode=(DEVICEMODE *)malloc(sizeof(DEVICEMODE));
-       ZERO_STRUCTP(devmode);  
-       construct_dev_mode(devmode, snum, global_myname);                       
-       job_info->devmode=devmode;
+       if((job_info->devmode = construct_dev_mode(snum, global_myname)) == NULL) {
+               free_a_printer(&ntprinter, 2);
+               return False;
+       }
 
-       free_a_printer(ntprinter, 2);
+       job_info->devmode=devmode;
+       free_a_printer(&ntprinter, 2);
        return (True);
 }
 
@@ -2985,25 +3224,31 @@ static uint32 enumjobs_level1(print_queue_struct *queue, int snum,
        int i;
        
        info=(JOB_INFO_1 *)malloc(*returned*sizeof(JOB_INFO_1));
+       if (info==NULL) {
+               safe_free(queue);
+               *returned=0;
+               return ERROR_NOT_ENOUGH_MEMORY;
+       }
        
        for (i=0; i<*returned; i++)
-       {
                fill_job_info_1(&(info[i]), &(queue[i]), i, snum);
-       }
+
+       safe_free(queue);
 
        /* check the required size. */  
        for (i=0; i<*returned; i++)
                (*needed) += spoolss_size_job_info_1(&(info[i]));
 
-       if (!alloc_buffer_size(buffer, *needed))
+       if (!alloc_buffer_size(buffer, *needed)) {
+               safe_free(info);
                return ERROR_INSUFFICIENT_BUFFER;
+       }
 
        /* fill the buffer with the structures */
        for (i=0; i<*returned; i++)
                new_smb_io_job_info_1("", buffer, &(info[i]), 0);       
 
        /* clear memory */
-       safe_free(queue);
        safe_free(info);
 
        if (*needed > offered) {
@@ -3025,25 +3270,31 @@ static uint32 enumjobs_level2(print_queue_struct *queue, int snum,
        int i;
        
        info=(JOB_INFO_2 *)malloc(*returned*sizeof(JOB_INFO_2));
+       if (info==NULL) {
+               safe_free(queue);
+               *returned=0;
+               return ERROR_NOT_ENOUGH_MEMORY;
+       }
        
        for (i=0; i<*returned; i++)
-       {
                fill_job_info_2(&(info[i]), &(queue[i]), i, snum);
-       }
+
+       safe_free(queue);
 
        /* check the required size. */  
        for (i=0; i<*returned; i++)
                (*needed) += spoolss_size_job_info_2(&(info[i]));
 
-       if (!alloc_buffer_size(buffer, *needed))
+       if (!alloc_buffer_size(buffer, *needed)) {
+               safe_free(info);
                return ERROR_INSUFFICIENT_BUFFER;
+       }
 
        /* fill the buffer with the structures */
        for (i=0; i<*returned; i++)
                new_smb_io_job_info_2("", buffer, &(info[i]), 0);       
 
        /* clear memory */
-       safe_free(queue);
        safe_free(info);
 
        if (*needed > offered) {
@@ -3073,11 +3324,9 @@ uint32 _spoolss_enumjobs( POLICY_HND *handle, uint32 firstjob, uint32 numofjobs,
        *returned=0;
 
        if (!get_printer_snum(handle, &snum))
-       {
-               return NT_STATUS_INVALID_HANDLE;
-       }
+               return ERROR_INVALID_HANDLE;
 
-       *returned = get_printqueue(snum, NULL, &queue, &prt_status);
+       *returned = print_queue_status(snum, &queue, &prt_status);
        DEBUGADD(4,("count:[%d], status:[%d], [%s]\n", *returned, prt_status.status, prt_status.message));
 
        switch (level) {
@@ -3088,13 +3337,14 @@ uint32 _spoolss_enumjobs( POLICY_HND *handle, uint32 firstjob, uint32 numofjobs,
                return enumjobs_level2(queue, snum, buffer, offered, needed, returned);
                break;                          
        default:
-               return NT_STATUS_INVALID_LEVEL;
+               safe_free(queue);
+               *returned=0;
+               return ERROR_INVALID_LEVEL;
                break;
        }
 }
 
 
-
 /****************************************************************************
 ****************************************************************************/
 uint32 _spoolss_schedulejob( const POLICY_HND *handle, uint32 jobid)
@@ -3112,58 +3362,34 @@ uint32 _spoolss_setjob( const POLICY_HND *handle,
 
 {
        int snum;
-       print_queue_struct *queue=NULL;
        print_status_struct prt_status;
-       int i=0;
-       BOOL found=False;
-       int count;
                
        memset(&prt_status, 0, sizeof(prt_status));
 
-       if (!get_printer_snum(handle, &snum))
-       {
-               return NT_STATUS_INVALID_HANDLE;
+       if (!get_printer_snum(handle, &snum)) {
+               return ERROR_INVALID_HANDLE;
        }
 
-       count=get_printqueue(snum, NULL, &queue, &prt_status);          
-
-       while ( (i<count) && found==False )
-       {
-               if ( jobid == queue[i].job )
-               {
-                       found=True;
-               }
-               i++;
+       if (!print_job_exists(jobid)) {
+               return ERROR_INVALID_PRINTER_NAME;
        }
        
-       if (found==True)
-       {
-               switch (command)
-               {
-                       case JOB_CONTROL_CANCEL:
-                       case JOB_CONTROL_DELETE:
-                       {
-                               del_printqueue(NULL, snum, jobid);
-                               safe_free(queue);
-                               return 0x0;
-                       }
-                       case JOB_CONTROL_PAUSE:
-                       {
-                               status_printjob(NULL, snum, jobid, LPQ_PAUSED);
-                               safe_free(queue);
-                               return 0x0;
-                       }
-                       case JOB_CONTROL_RESUME:
-                       {
-                               status_printjob(NULL, snum, jobid, LPQ_QUEUED);
-                               safe_free(queue);
-                               return 0x0;
-                       }
-               }
+       switch (command) {
+       case JOB_CONTROL_CANCEL:
+       case JOB_CONTROL_DELETE:
+               if (print_job_delete(jobid)) return 0x0;
+               break;
+       case JOB_CONTROL_PAUSE:
+               if (print_job_pause(jobid)) return 0x0;
+               break;
+       case JOB_CONTROL_RESUME:
+               if (print_job_resume(jobid)) return 0x0;
+               break;
+       default:
+               return ERROR_INVALID_LEVEL;
        }
-       safe_free(queue);
-       return NT_STATUS_INVALID_INFO_CLASS;
 
+       return ERROR_INVALID_HANDLE;
 }
 
 /****************************************************************************
@@ -3174,17 +3400,21 @@ static uint32 enumprinterdrivers_level1(fstring *list, fstring servername, fstri
        int i;
        NT_PRINTER_DRIVER_INFO_LEVEL driver;
        DRIVER_INFO_1 *driver_info_1=NULL;
-       driver_info_1=(DRIVER_INFO_1 *)malloc(*returned * sizeof(DRIVER_INFO_1));
+
+       ZERO_STRUCT(driver);
+
+       if((driver_info_1=(DRIVER_INFO_1 *)malloc(*returned * sizeof(DRIVER_INFO_1))) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
 
        for (i=0; i<*returned; i++) {
                get_a_printer_driver(&driver, 3, list[i], architecture);
                fill_printer_driver_info_1(&(driver_info_1[i]), driver, servername, architecture );
-               free_a_printer_driver(driver, 3);
        }
        
+       safe_free(list);
+       
        /* check the required size. */
-       for (i=0; i<*returned; i++)
-       {
+       for (i=0; i<*returned; i++) {
                DEBUGADD(6,("adding driver [%d]'s size\n",i));
                *needed += spoolss_size_printer_driver_info_1(&(driver_info_1[i]));
        }
@@ -3195,8 +3425,7 @@ static uint32 enumprinterdrivers_level1(fstring *list, fstring servername, fstri
        }
 
        /* fill the buffer with the form structures */
-       for (i=0; i<*returned; i++)
-       {
+       for (i=0; i<*returned; i++) {
                DEBUGADD(6,("adding driver [%d] to buffer\n",i));
                new_smb_io_printer_driver_info_1("", buffer, &(driver_info_1[i]), 0);
        }
@@ -3217,19 +3446,27 @@ static uint32 enumprinterdrivers_level1(fstring *list, fstring servername, fstri
 static uint32 enumprinterdrivers_level2(fstring *list, fstring servername, fstring architecture, NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        int i;
-       NT_PRINTER_DRIVER_INFO_LEVEL driver;
        DRIVER_INFO_2 *driver_info_2=NULL;
-       driver_info_2=(DRIVER_INFO_2 *)malloc(*returned * sizeof(DRIVER_INFO_2));
+
+       if (*returned > 0 && 
+           !(driver_info_2=(DRIVER_INFO_2 *)malloc(*returned * sizeof(DRIVER_INFO_2))))
+               return ERROR_NOT_ENOUGH_MEMORY;
 
        for (i=0; i<*returned; i++) {
-               get_a_printer_driver(&driver, 3, list[i], architecture);
+               NT_PRINTER_DRIVER_INFO_LEVEL driver;
+               ZERO_STRUCT(driver);
+               if (get_a_printer_driver(&driver, 3, list[i], architecture)
+                   != 0) { 
+                       *returned = i;
+                       break;
+               }
                fill_printer_driver_info_2(&(driver_info_2[i]), driver, servername, architecture );
-               free_a_printer_driver(driver, 3);
        }
        
+       safe_free(list);
+       
        /* check the required size. */
-       for (i=0; i<*returned; i++)
-       {
+       for (i=0; i<*returned; i++) {
                DEBUGADD(6,("adding driver [%d]'s size\n",i));
                *needed += spoolss_size_printer_driver_info_2(&(driver_info_2[i]));
        }
@@ -3240,8 +3477,7 @@ static uint32 enumprinterdrivers_level2(fstring *list, fstring servername, fstri
        }
 
        /* fill the buffer with the form structures */
-       for (i=0; i<*returned; i++)
-       {
+       for (i=0; i<*returned; i++) {
                DEBUGADD(6,("adding driver [%d] to buffer\n",i));
                new_smb_io_printer_driver_info_2("", buffer, &(driver_info_2[i]), 0);
        }
@@ -3264,35 +3500,45 @@ static uint32 enumprinterdrivers_level3(fstring *list, fstring servername, fstri
        int i;
        NT_PRINTER_DRIVER_INFO_LEVEL driver;
        DRIVER_INFO_3 *driver_info_3=NULL;
-       driver_info_3=(DRIVER_INFO_3 *)malloc((*returned)*sizeof(DRIVER_INFO_3));
+
+       ZERO_STRUCT(driver);
+
+       if((driver_info_3=(DRIVER_INFO_3 *)malloc((*returned)*sizeof(DRIVER_INFO_3))) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
 
        for (i=0; i<*returned; i++) {
                get_a_printer_driver(&driver, 3, list[i], architecture);
                fill_printer_driver_info_3(&(driver_info_3[i]), driver, servername, architecture );
-               free_a_printer_driver(driver, 3);
        }
        
+       safe_free(list);
+       
        /* check the required size. */
-       for (i=0; i<*returned; i++)
-       {
+       for (i=0; i<*returned; i++) {
                DEBUGADD(6,("adding driver [%d]'s size\n",i));
                *needed += spoolss_size_printer_driver_info_3(&(driver_info_3[i]));
        }
 
-       if (!alloc_buffer_size(buffer, *needed))
+       if (!alloc_buffer_size(buffer, *needed)) {
+               safe_free(driver_info_3);
                return ERROR_INSUFFICIENT_BUFFER;
-
+       }
+       
        /* fill the buffer with the form structures */
-       for (i=0; i<*returned; i++)
-       {
+       for (i=0; i<*returned; i++) {
                DEBUGADD(6,("adding form [%d] to buffer\n",i));
                new_smb_io_printer_driver_info_3("", buffer, &(driver_info_3[i]), 0);
        }
 
-       safe_free(list);
-
-       if (*needed > offered)
+       for (i=0; i<*returned; i++)
+               safe_free(driver_info_3[i].dependentfiles);
+       
+       safe_free(driver_info_3);
+       
+       if (*needed > offered) {
+               *returned=0;
                return ERROR_INSUFFICIENT_BUFFER;
+       }
        else
                return NT_STATUS_NO_PROBLEMO;
 }
@@ -3305,7 +3551,7 @@ uint32 _spoolss_enumprinterdrivers( UNISTR2 *name, UNISTR2 *environment, uint32
                                    uint32 *needed, uint32 *returned)
 {
        int i;
-       fstring *list;
+       fstring *list = NULL;
        fstring servername;
        fstring architecture;
 
@@ -3318,6 +3564,9 @@ uint32 _spoolss_enumprinterdrivers( UNISTR2 *name, UNISTR2 *environment, uint32
        *returned=get_ntdrivers(&list, architecture);
 
        DEBUGADD(4,("we have: [%d] drivers in environment [%s]\n", *returned, architecture));
+       if(*returned == -1)
+               return ERROR_NOT_ENOUGH_MEMORY;
+
        for (i=0; i<*returned; i++)
                DEBUGADD(5,("driver: [%s]\n", list[i]));
        
@@ -3332,7 +3581,7 @@ uint32 _spoolss_enumprinterdrivers( UNISTR2 *name, UNISTR2 *environment, uint32
                return enumprinterdrivers_level3(list, servername, architecture, buffer, offered, needed, returned);
                break;
        default:
-               return NT_STATUS_INVALID_INFO_CLASS;
+               return ERROR_INVALID_LEVEL;
                break;
        }
 }
@@ -3369,20 +3618,25 @@ uint32 _new_spoolss_enumforms( const POLICY_HND *handle, uint32 level,
        *numofforms = get_ntforms(&list);
        DEBUGADD(5,("Number of forms [%d]\n",     *numofforms));
 
+       if (*numofforms == 0) return ERROR_NO_MORE_ITEMS;
+
        switch (level) {
        case 1:
-               forms_1=(FORM_1 *)malloc(*numofforms * sizeof(FORM_1));
+               if ((forms_1=(FORM_1 *)malloc(*numofforms * sizeof(FORM_1))) == NULL) {
+                       *numofforms=0;
+                       return ERROR_NOT_ENOUGH_MEMORY;
+               }
 
                /* construct the list of form structures */
-               for (i=0; i<*numofforms; i++)
-               {
+               for (i=0; i<*numofforms; i++) {
                        DEBUGADD(6,("Filling form number [%d]\n",i));
                        fill_form_1(&(forms_1[i]), &(list[i]), i);
                }
+               
+               safe_free(list);
 
                /* check the required size. */
-               for (i=0; i<*numofforms; i++)
-               {
+               for (i=0; i<*numofforms; i++) {
                        DEBUGADD(6,("adding form [%d]'s size\n",i));
                        buffer_size += spoolss_size_form_1(&(forms_1[i]));
                }
@@ -3390,21 +3644,22 @@ uint32 _new_spoolss_enumforms( const POLICY_HND *handle, uint32 level,
                *needed=buffer_size;            
                
                if (!alloc_buffer_size(buffer, buffer_size)){
-                       safe_free(list);
+                       safe_free(forms_1);
                        return ERROR_INSUFFICIENT_BUFFER;
                }
 
                /* fill the buffer with the form structures */
-               for (i=0; i<*numofforms; i++)
-               {
+               for (i=0; i<*numofforms; i++) {
                        DEBUGADD(6,("adding form [%d] to buffer\n",i));
                        new_smb_io_form_1("", buffer, &(forms_1[i]), 0);
                }
 
-               safe_free(list);
+               safe_free(forms_1);
 
-               if (*needed > offered)
+               if (*needed > offered) {
+                       *numofforms=0;
                        return ERROR_INSUFFICIENT_BUFFER;
+               }
                else
                        return NT_STATUS_NO_PROBLEMO;
                        
@@ -3449,7 +3704,8 @@ static uint32 enumports_level_1(NEW_BUFFER *buffer, uint32 offered, uint32 *need
                if ( lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) )
                        (*returned)++;
 
-       ports=(PORT_INFO_1 *)malloc( (*returned+1) * sizeof(PORT_INFO_1) );
+       if((ports=(PORT_INFO_1 *)malloc( (*returned+1) * sizeof(PORT_INFO_1) )) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
        
        for (snum=0; snum<n_services; snum++) {
                if ( lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) ) {
@@ -3502,7 +3758,8 @@ static uint32 enumports_level_2(NEW_BUFFER *buffer, uint32 offered, uint32 *need
                if ( lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) )
                        (*returned)++;
 
-       ports=(PORT_INFO_2 *)malloc( (*returned+1) * sizeof(PORT_INFO_2) );
+       if((ports=(PORT_INFO_2 *)malloc( (*returned+1) * sizeof(PORT_INFO_2) )) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
        
        for (snum=0; snum<n_services; snum++) {
                if ( lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) ) {
@@ -3559,76 +3816,165 @@ uint32 _spoolss_enumports( UNISTR2 *name, uint32 level,
                return enumports_level_2(buffer, offered, needed, returned);
                break;
        default:
-               return NT_STATUS_INVALID_INFO_CLASS;
+               return ERROR_INVALID_LEVEL;
                break;
        }
 }
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_addprinterex( const UNISTR2 *uni_srv_name, uint32 level,
+static uint32 spoolss_addprinterex_level_2( const UNISTR2 *uni_srv_name,
                                const SPOOL_PRINTER_INFO_LEVEL *info,
                                uint32 unk0, uint32 unk1, uint32 unk2, uint32 unk3,
                                uint32 user_switch, const SPOOL_USER_CTR *user,
                                POLICY_HND *handle)
 {
-       NT_PRINTER_INFO_LEVEL printer;  
+       NT_PRINTER_INFO_LEVEL *printer = NULL;
        fstring name;
        fstring share_name;
 
+       if ((printer = (NT_PRINTER_INFO_LEVEL *)malloc(sizeof(NT_PRINTER_INFO_LEVEL))) == NULL) {
+               DEBUG(0,("spoolss_addprinterex_level_2: malloc fail.\n"));
+               return ERROR_NOT_ENOUGH_MEMORY;
+       }
+
+       ZERO_STRUCTP(printer);
+
        clear_handle(handle);
        
-/* 
- * FIX: JFM: we need to check the user here !!!!
- *
- * as the code is running as root, anybody can add printers to the server
- */
-       /* NULLify info_2 here */
-       /* don't put it in convert_printer_info as it's used also with non-NULL values */
-       printer.info_2=NULL;
+       /* convert from UNICODE to ASCII - this allocates the info_2 struct inside *printer.*/
+       convert_printer_info(info, printer, 2);
 
-       /* convert from UNICODE to ASCII */
-       convert_printer_info(info, &printer, level);
-
-       unistr2_to_ascii(share_name, &((info->info_2)->printername), sizeof(share_name)-1);
+       unistr2_to_ascii(share_name, &info->info_2->printername, sizeof(share_name)-1);
        
        slprintf(name, sizeof(name)-1, "\\\\%s\\%s", global_myname, share_name);
 
        /* write the ASCII on disk */
-       if (add_a_printer(printer, level) != 0x0)
+       if (add_a_printer(*printer, 2) != 0) {
+               free_a_printer(&printer,2);
                return ERROR_ACCESS_DENIED;
+       }
 
        create_printer_hnd(handle);
 
        open_printer_hnd(handle);
 
        if (!set_printer_hnd_printertype(handle, name)) {
+               free_a_printer(&printer,2);
                close_printer_handle(handle);
                return ERROR_ACCESS_DENIED;
        }
 
        if (!set_printer_hnd_printername(handle, name)) {
+               free_a_printer(&printer,2);
                close_printer_handle(handle);
                return ERROR_ACCESS_DENIED;
        }
 
+       free_a_printer(&printer,2);
        return NT_STATUS_NO_PROBLEMO;
 }
 
+/****************************************************************************
+****************************************************************************/
+uint32 _spoolss_addprinterex( const UNISTR2 *uni_srv_name, uint32 level,
+                               const SPOOL_PRINTER_INFO_LEVEL *info,
+                               uint32 unk0, uint32 unk1, uint32 unk2, uint32 unk3,
+                               uint32 user_switch, const SPOOL_USER_CTR *user,
+                               POLICY_HND *handle)
+{
+       switch (level) {
+               case 1:
+                       /* we don't handle yet */
+                       /* but I know what to do ... */
+                       return ERROR_INVALID_LEVEL;
+                       break;
+               case 2:
+                       return spoolss_addprinterex_level_2(uni_srv_name, info, 
+                                                           unk0, unk1, unk2, unk3,
+                                                           user_switch, user, handle);
+                       break;
+               default:
+                       return ERROR_INVALID_LEVEL;
+                       break;
+       }
+}
+
+/****************************************************************************
+ Modify internal driver heirarchy.
+****************************************************************************/
+
+#if MANGLE_DRIVER_PATH
+static uint32 modify_driver_heirarchy(NT_PRINTER_DRIVER_INFO_LEVEL *driver, uint32 level)
+{
+       pstring path_old;
+       pstring path_new;
+       pstring short_archi;
+       pstring model_name;
+
+       /* find_service is an smbd-specific function call */
+       int snum = find_service("print$");
+       char *model = NULL;
+
+       *short_archi = '\0';
+       switch (level) {
+               case 3:
+                       get_short_archi(short_archi, driver->info_3->environment);
+                       model = driver->info_3->name;
+                       break;
+               case 6:
+                       get_short_archi(short_archi, driver->info_6->environment);
+                       model = driver->info_6->name;
+                       break;
+               default:
+                       DEBUG(0,("modify_driver_heirarchy: unknown info level (%d)\n", level));
+                       return ERROR_INVALID_LEVEL;
+                       break;
+       }
+
+       slprintf(path_old, sizeof(path_old)-1, "%s/%s/TMP_%s", lp_pathname(snum), short_archi,
+               client_addr());
+
+       /* Clean up any '/' and other characters in the model name. */
+       alpha_strcpy(model_name, model, sizeof(pstring));
+
+       slprintf(path_new, sizeof(path_new)-1, "%s/%s/%s", lp_pathname(snum), short_archi, model_name);
+
+       DEBUG(10,("modify_driver_heirarchy: old_path=%s, new_path=%s\n",
+                       path_old, path_new ));
+       if (dos_rename(path_old, path_new) == -1) {
+               DEBUG(0,("modify_driver_heirarchy: rename from %s to %s failed (%s)\n", 
+                       path_old, path_new, strerror(errno) ));
+               /* We need to clean up here.... - how ? */
+               return ERROR_ACCESS_DENIED; /* We need a generic mapping from NT errors here... */
+       }
+
+       return NT_STATUS_NO_PROBLEMO;
+}
+#endif
+
 /****************************************************************************
 ****************************************************************************/
 uint32 _spoolss_addprinterdriver( const UNISTR2 *server_name,
                                uint32 level,
                                const SPOOL_PRINTER_DRIVER_INFO_LEVEL *info)
 {
+       uint32 err = NT_STATUS_NO_PROBLEMO;
        NT_PRINTER_DRIVER_INFO_LEVEL driver;
+       ZERO_STRUCT(driver);
        
        convert_printer_driver_info(info, &driver, level);
 
        if (add_a_printer_driver(driver, level)!=0)
-               return NT_STATUS_ACCESS_DENIED;
+               return ERROR_ACCESS_DENIED;
 
-       return NT_STATUS_NO_PROBLEMO;
+#if MANGLE_DRIVER_PATH
+       err = modify_driver_heirarchy(&driver, level);
+#endif
+
+       free_a_printer_driver(driver, level);
+
+       return err;
 }
 
 /****************************************************************************
@@ -3642,23 +3988,29 @@ static void fill_driverdir_1(DRIVER_DIRECTORY_1 *info, char *name)
 ****************************************************************************/
 static uint32 getprinterdriverdir_level_1(UNISTR2 *name, UNISTR2 *uni_environment, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
-       pstring chaine;
+       pstring path;
        pstring long_archi;
        pstring short_archi;
        DRIVER_DIRECTORY_1 *info=NULL;
        
-       info=(DRIVER_DIRECTORY_1 *)malloc(sizeof(DRIVER_DIRECTORY_1));
+       if((info=(DRIVER_DIRECTORY_1 *)malloc(sizeof(DRIVER_DIRECTORY_1))) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
        
        unistr2_to_ascii(long_archi, uni_environment, sizeof(long_archi)-1);
        get_short_archi(short_archi, long_archi);
                
-       slprintf(chaine, sizeof(chaine)-1, "\\\\%s\\print$\\%s", global_myname, short_archi);
-
-       DEBUG(4,("printer driver directory: [%s]\n", chaine));
+#if MANGLE_DRIVER_PATH
+       slprintf(path, sizeof(path)-1, "\\\\%s\\print$\\%s\\TMP_%s", global_myname, short_archi,
+               client_addr());
+#else
+       slprintf(path, sizeof(path)-1, "\\\\%s\\print$\\%s",
+                       global_myname, short_archi);
+#endif
+       DEBUG(4,("printer driver directory: [%s]\n", path));
 
-       fill_driverdir_1(info, chaine);
+       fill_driverdir_1(info, path);
        
-       *needed += spoolss_size_driverdir_info_1(info);                                                     
+       *needed += spoolss_size_driverdir_info_1(info);
 
        if (!alloc_buffer_size(buffer, *needed)) {
                safe_free(info);
@@ -3703,7 +4055,7 @@ uint32 _spoolss_enumprinterdata(const POLICY_HND *handle, uint32 idx,
                                uint32 *out_type,
                                uint32 *out_max_data_len, uint8  **data_out, uint32 *out_data_len)
 {
-       NT_PRINTER_INFO_LEVEL printer;
+       NT_PRINTER_INFO_LEVEL *printer = NULL;
        
        fstring value;
        
@@ -3731,13 +4083,13 @@ uint32 _spoolss_enumprinterdata(const POLICY_HND *handle, uint32 idx,
        DEBUG(5,("spoolss_enumprinterdata\n"));
 
        if (!OPEN_HANDLE(Printer))
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
 
        if (!get_printer_snum(handle, &snum))
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
        
        if (get_a_printer(&printer, 2, lp_servicename(snum)) != 0x0)
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
 
        /* 
         * The NT machine wants to know the biggest size of value and data
@@ -3751,7 +4103,7 @@ uint32 _spoolss_enumprinterdata(const POLICY_HND *handle, uint32 idx,
                biggest_valuesize=0;
                biggest_datasize=0;
                
-               while (get_specific_param_by_index(printer, 2, param_index, value, &data, &type, &data_len)) {
+               while (get_specific_param_by_index(*printer, 2, param_index, value, &data, &type, &data_len)) {
                        if (strlen(value) > biggest_valuesize) biggest_valuesize=strlen(value);
                        if (data_len > biggest_datasize) biggest_datasize=data_len;
 
@@ -3767,7 +4119,7 @@ uint32 _spoolss_enumprinterdata(const POLICY_HND *handle, uint32 idx,
 
                DEBUG(6,("final values: [%d], [%d]\n", *out_value_len, *out_data_len));
 
-               free_a_printer(printer, 2);             
+               free_a_printer(&printer, 2);
                return NT_STATUS_NO_PROBLEMO;
        }
        
@@ -3776,11 +4128,14 @@ uint32 _spoolss_enumprinterdata(const POLICY_HND *handle, uint32 idx,
         * that's the number of bytes not the number of unicode chars
         */
 
-       if (!get_specific_param_by_index(printer, 2, idx, value, &data, &type, &data_len)) {
-               free_a_printer(printer, 2);
+       if (!get_specific_param_by_index(*printer, 2, idx, value, &data, &type, &data_len)) {
+               safe_free(data);
+               free_a_printer(&printer, 2);
                return ERROR_NO_MORE_ITEMS;
        }
-                       
+
+       free_a_printer(&printer, 2);
+
        /* 
         * the value is:
         * - counted in bytes in the request
@@ -3790,22 +4145,27 @@ uint32 _spoolss_enumprinterdata(const POLICY_HND *handle, uint32 idx,
         * take a pause *before* coding not *during* coding
         */
         
-       *out_max_value_len=in_value_len/2;
-       *out_value=(uint16 *)malloc(in_value_len*sizeof(uint8));
-       ascii_to_unistr(*out_value, value, *out_max_value_len);
+       *out_max_value_len=in_value_len;
+       if((*out_value=(uint16 *)malloc(in_value_len*sizeof(uint8))) == NULL) {
+               safe_free(data);
+               return ERROR_NOT_ENOUGH_MEMORY;
+       }
+       ascii_to_unistr((char *)*out_value, value, *out_max_value_len);
        *out_value_len=2*(1+strlen(value));
 
        *out_type=type;
 
        /* the data is counted in bytes */
        *out_max_data_len=in_data_len;
-       *data_out=(uint8 *)malloc(in_data_len*sizeof(uint8));
+       if((*data_out=(uint8 *)malloc(in_data_len*sizeof(uint8))) == NULL) {
+               safe_free(data);
+               return ERROR_NOT_ENOUGH_MEMORY;
+       }
        memcpy(*data_out, data, data_len);
        *out_data_len=data_len;
 
        safe_free(data);
        
-       free_a_printer(printer, 2);
        return NT_STATUS_NO_PROBLEMO;
 }
 
@@ -3819,7 +4179,7 @@ uint32 _spoolss_setprinterdata( const POLICY_HND *handle,
                                uint32 real_len,
                                uint32 numeric_data)
 {
-       NT_PRINTER_INFO_LEVEL printer;
+       NT_PRINTER_INFO_LEVEL *printer = NULL;
        NT_PRINTER_PARAM *param = NULL;
                
        int snum=0;
@@ -3830,28 +4190,24 @@ uint32 _spoolss_setprinterdata( const POLICY_HND *handle,
 
        
        if (!OPEN_HANDLE(Printer))
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
 
        if (!get_printer_snum(handle, &snum))
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
 
        status = get_a_printer(&printer, 2, lp_servicename(snum));
        if (status != 0x0)
-               return status;
+               return ERROR_INVALID_NAME;
 
        convert_specific_param(&param, value , type, data, real_len);
-       unlink_specific_param_if_exist(printer.info_2, param);
+       unlink_specific_param_if_exist(printer->info_2, param);
        
-       if (!add_a_specific_param(printer.info_2, param))
-       {
-               status = NT_STATUS_INVALID_PARAMETER;
-       }
+       if (!add_a_specific_param(printer->info_2, param))
+               status = ERROR_INVALID_PARAMETER;
        else
-       {
-               status = add_a_printer(printer, 2);
-       }
-       free_a_printer(printer, 2);
-       
+               status = add_a_printer(*printer, 2);
+
+       free_a_printer(&printer, 2);
        return status;
 }
 
@@ -3868,10 +4224,11 @@ uint32 _spoolss_addform( const POLICY_HND *handle,
        DEBUG(5,("spoolss_addform\n"));
 
        if (!OPEN_HANDLE(Printer))
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
 
        count=get_ntforms(&list);
-       add_a_form(&list, form, &count);
+       if(!add_a_form(&list, form, &count))
+               return ERROR_NOT_ENOUGH_MEMORY;
        write_ntforms(&list, count);
 
        safe_free(list);
@@ -3894,7 +4251,7 @@ uint32 _spoolss_setform( const POLICY_HND *handle,
 
        if (!OPEN_HANDLE(Printer))
        {
-               return NT_STATUS_INVALID_HANDLE;
+               return ERROR_INVALID_HANDLE;
        }
        count=get_ntforms(&list);
        update_a_form(&list, form, count);
@@ -3912,7 +4269,9 @@ static uint32 enumprintprocessors_level_1(NEW_BUFFER *buffer, uint32 offered, ui
 {
        PRINTPROCESSOR_1 *info_1=NULL;
        
-       info_1 = (PRINTPROCESSOR_1 *)malloc(sizeof(PRINTPROCESSOR_1));
+       if((info_1 = (PRINTPROCESSOR_1 *)malloc(sizeof(PRINTPROCESSOR_1))) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
+
        (*returned) = 0x1;
        
        init_unistr(&(info_1->name), "winprint");
@@ -3957,7 +4316,7 @@ uint32 _spoolss_enumprintprocessors(UNISTR2 *name, UNISTR2 *environment, uint32
                return enumprintprocessors_level_1(buffer, offered, needed, returned);
                break;
        default:
-               return NT_STATUS_INVALID_INFO_CLASS;
+               return ERROR_INVALID_LEVEL;
                break;
        }
 }
@@ -3969,7 +4328,9 @@ static uint32 enumprintprocdatatypes_level_1(NEW_BUFFER *buffer, uint32 offered,
 {
        PRINTPROCDATATYPE_1 *info_1=NULL;
        
-       info_1 = (PRINTPROCDATATYPE_1 *)malloc(sizeof(PRINTPROCDATATYPE_1));
+       if((info_1 = (PRINTPROCDATATYPE_1 *)malloc(sizeof(PRINTPROCDATATYPE_1))) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
+
        (*returned) = 0x1;
        
        init_unistr(&(info_1->name), "RAW");
@@ -4007,7 +4368,7 @@ uint32 _spoolss_enumprintprocdatatypes(UNISTR2 *name, UNISTR2 *processor, uint32
                return enumprintprocdatatypes_level_1(buffer, offered, needed, returned);
                break;
        default:
-               return NT_STATUS_INVALID_INFO_CLASS;
+               return ERROR_INVALID_LEVEL;
                break;
        }
 }
@@ -4019,7 +4380,9 @@ static uint32 enumprintmonitors_level_1(NEW_BUFFER *buffer, uint32 offered, uint
 {
        PRINTMONITOR_1 *info_1=NULL;
        
-       info_1 = (PRINTMONITOR_1 *)malloc(sizeof(PRINTMONITOR_1));
+       if((info_1 = (PRINTMONITOR_1 *)malloc(sizeof(PRINTMONITOR_1))) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
+
        (*returned) = 0x1;
        
        init_unistr(&(info_1->name), "Local Port");
@@ -4048,7 +4411,9 @@ static uint32 enumprintmonitors_level_2(NEW_BUFFER *buffer, uint32 offered, uint
 {
        PRINTMONITOR_2 *info_2=NULL;
        
-       info_2 = (PRINTMONITOR_2 *)malloc(sizeof(PRINTMONITOR_2));
+       if((info_2 = (PRINTMONITOR_2 *)malloc(sizeof(PRINTMONITOR_2))) == NULL)
+               return ERROR_NOT_ENOUGH_MEMORY;
+
        (*returned) = 0x1;
        
        init_unistr(&(info_2->name), "Local Port");
@@ -4098,7 +4463,7 @@ uint32 _spoolss_enumprintmonitors(UNISTR2 *name,uint32 level,
                return enumprintmonitors_level_2(buffer, offered, needed, returned);
                break;
        default:
-               return NT_STATUS_INVALID_INFO_CLASS;
+               return ERROR_INVALID_LEVEL;
                break;
        }
 }
@@ -4110,11 +4475,12 @@ static uint32 getjob_level_1(print_queue_struct *queue, int count, int snum, uin
        int i=0;
        BOOL found=False;
        JOB_INFO_1 *info_1=NULL;
+
        info_1=(JOB_INFO_1 *)malloc(sizeof(JOB_INFO_1));
 
        if (info_1 == NULL) {
                safe_free(queue);
-               return NT_STATUS_NO_MEMORY;
+               return ERROR_NOT_ENOUGH_MEMORY;
        }
                
        for (i=0; i<count && found==False; i++) {
@@ -4124,16 +4490,21 @@ static uint32 getjob_level_1(print_queue_struct *queue, int count, int snum, uin
        
        if (found==False) {
                safe_free(queue);
+               safe_free(info_1);
                /* I shoud reply something else ... I can't find the good one */
                return NT_STATUS_NO_PROBLEMO;
        }
        
-       fill_job_info_1(info_1, &(queue[i]), i, snum);
+       fill_job_info_1(info_1, &(queue[i-1]), i, snum);
+       
+       safe_free(queue);
        
        *needed += spoolss_size_job_info_1(info_1);
 
-       if (!alloc_buffer_size(buffer, *needed))
+       if (!alloc_buffer_size(buffer, *needed)) {
+               safe_free(info_1);
                return ERROR_INSUFFICIENT_BUFFER;
+       }
 
        new_smb_io_job_info_1("", buffer, info_1, 0);
 
@@ -4148,8 +4519,6 @@ static uint32 getjob_level_1(print_queue_struct *queue, int count, int snum, uin
 
 /****************************************************************************
 ****************************************************************************/
-#if 0
-... Not yet used...
 static uint32 getjob_level_2(print_queue_struct *queue, int count, int snum, uint32 jobid, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
 {
        int i=0;
@@ -4159,7 +4528,7 @@ static uint32 getjob_level_2(print_queue_struct *queue, int count, int snum, uin
 
        if (info_2 == NULL) {
                safe_free(queue);
-               return NT_STATUS_NO_MEMORY;
+               return ERROR_NOT_ENOUGH_MEMORY;
        }
 
        for (i=0; i<count && found==False; i++) {
@@ -4169,16 +4538,21 @@ static uint32 getjob_level_2(print_queue_struct *queue, int count, int snum, uin
        
        if (found==False) {
                safe_free(queue);
+               safe_free(info_2);
                /* I shoud reply something else ... I can't find the good one */
                return NT_STATUS_NO_PROBLEMO;
        }
        
-       fill_job_info_2(info_2, &(queue[i]), i, snum);
+       fill_job_info_2(info_2, &(queue[i-1]), i, snum);
+       
+       safe_free(queue);
        
        *needed += spoolss_size_job_info_2(info_2);
 
-       if (!alloc_buffer_size(buffer, *needed))
+       if (!alloc_buffer_size(buffer, *needed)) {
+               safe_free(info_2);
                return ERROR_INSUFFICIENT_BUFFER;
+       }
 
        new_smb_io_job_info_2("", buffer, info_2, 0);
 
@@ -4189,7 +4563,6 @@ static uint32 getjob_level_2(print_queue_struct *queue, int count, int snum, uin
        else
                return NT_STATUS_NO_PROBLEMO;
 }
-#endif
 
 /****************************************************************************
 ****************************************************************************/
@@ -4209,11 +4582,9 @@ uint32 _spoolss_getjob( POLICY_HND *handle, uint32 jobid, uint32 level,
        *needed=0;
        
        if (!get_printer_snum(handle, &snum))
-       {
-               return NT_STATUS_INVALID_HANDLE;
-       }
+               return ERROR_INVALID_HANDLE;
        
-       count=get_printqueue(snum, NULL, &queue, &prt_status);
+       count = print_queue_status(snum, &queue, &prt_status);
        
        DEBUGADD(4,("count:[%d], prt_status:[%d], [%s]\n",
                     count, prt_status.status, prt_status.message));
@@ -4223,12 +4594,12 @@ uint32 _spoolss_getjob( POLICY_HND *handle, uint32 jobid, uint32 level,
                return getjob_level_1(queue, count, snum, jobid, buffer, offered, needed);
                break;
        case 2:
-               return getjob_level_1(queue, count, snum, jobid, buffer, offered, needed);
+               return getjob_level_2(queue, count, snum, jobid, buffer, offered, needed);
                break;
        default:
                safe_free(queue);
-               return NT_STATUS_INVALID_INFO_CLASS;
+               return ERROR_INVALID_LEVEL;
                break;
        }
 }
-       
+#undef OLD_NTDOMAIN