r6191: fix spoolss_Enum* push code

metze
(This used to be commit e66aa87f148d04f4c44b08555345600b8a6278d4)

diff --git a/source4/librpc/ndr/ndr_spoolss_buf.c b/source4/librpc/ndr/ndr_spoolss_buf.c
index 2bc55db7588c2e12a21600fbe7cea77dfe6a9230..de4a87547d74dc38b1733e50d679a5e12fdcea2a 100644 (file)
--- a/source4/librpc/ndr/ndr_spoolss_buf.c
+++ b/source4/librpc/ndr/ndr_spoolss_buf.c
@@ -29,27 +29,33 @@
        DATA_BLOB buffer;\
        if (r->out.info) {\
                int i;\
+               size_t size;\
+               uint8_t *data;\
                struct ndr_push *ndr2;\
 \
                ndr2 = ndr_push_init_ctx(ndr);\
                if (!ndr2) {\
                        return NT_STATUS_NO_MEMORY;\
                }\
+\
+               size = ndr2->offset;\
+               data = ndr2->data;\
 \
                for (i=0;i<r->out.count;i++) {\
                        ndr2->data += ndr2->offset;\
                        ndr2->offset = 0;\
                        NDR_CHECK(ndr_push_set_switch_value(ndr2, &(*r->out.info)[i], r->in.level)); \
                        NDR_CHECK(ndr_push_##type(ndr2, NDR_SCALARS|NDR_BUFFERS, &(*r->out.info)[i]));\
+                       size += ndr2->offset;\
                }\
-               if (*r->in.buf_size >= ndr2->offset) {\
-                       buffer = data_blob_const(ndr2->data, ndr2->offset);\
+               if (*r->in.buf_size >= size) {\
+                       buffer = data_blob_const(data, size);\
                } else {\
                        r->out.info = NULL;\
                        r->out.count = 0;\
                        r->out.result = WERR_INSUFFICIENT_BUFFER;\
                }\
-               *r->out.buf_size = ndr2->offset;\
+               *r->out.buf_size = size;\
        }\
        NDR_CHECK(ndr_push_unique_ptr(ndr, r->out.info));\
        if (r->out.info) {\