* fix memory leak when constructing an driver_level_6 structure

  and no dependent files (working on smbd memory leak).  No CR# yet.

diff --git a/source/rpc_server/srv_spoolss_nt.c b/source/rpc_server/srv_spoolss_nt.c
index 6dd4352cbc5ed368934357abb7e9de700d811930..b5c5749f3c97faa00fd2d73de1b7e22b06691f85 100644 (file)
--- a/source/rpc_server/srv_spoolss_nt.c
+++ b/source/rpc_server/srv_spoolss_nt.c
@@ -4928,8 +4928,10 @@ static uint32 init_unistr_array(uint16 **uni_array, fstring *char_array, char *s
                        pstrcpy( line, v );
                        
                DEBUGADD(6,("%d:%s:%d\n", i, line, strlen(line)));
+
+               /* add one extra unit16 for the second terminating NULL */
                
-               if ( (tuary=Realloc(*uni_array, (j+strlen(line)+2)*sizeof(uint16))) == NULL ) {
+               if ( (tuary=Realloc(*uni_array, (j+1+strlen(line)+2)*sizeof(uint16))) == NULL ) {
                        DEBUG(2,("init_unistr_array: Realloc error\n" ));
                        return 0;
                } else
@@ -4943,6 +4945,9 @@ static uint32 init_unistr_array(uint16 **uni_array, fstring *char_array, char *s
        }
        
        if (*uni_array) {
+               /* special case for ""; we need to add both NULL's here */
+               if (!j)
+                       (*uni_array)[j++]=0x0000;       
                (*uni_array)[j]=0x0000;
        }
        
@@ -5172,6 +5177,7 @@ static WERROR construct_printer_driver_info_6(DRIVER_INFO_6 *info, int snum,
        fill_printer_driver_info_6(info, driver, servername);
 
        free_a_printer(&printer,2);
+       free_a_printer_driver(driver, 3);
 
        return WERR_OK;
 }