Merge of new 2.2 code into HEAD (Gerald I hate you :-) :-). Allows new SAMR
[bbaumbach/samba-autobuild/.git] / source / rpc_server / srv_spoolss_nt.c
index cd67a3b88a1f19f5fb260d8447a3c72bd053fec2..9fcf9930bf4b68f9c685f31c10d7462c2f799409 100644 (file)
@@ -1,4 +1,3 @@
-#define OLD_NTDOMAIN 1
 /*
  *  Unix SMB/Netbios implementation.
  *  Version 1.9.
@@ -6,6 +5,7 @@
  *  Copyright (C) Andrew Tridgell              1992-2000,
  *  Copyright (C) Luke Kenneth Casson Leighton 1996-2000,
  *  Copyright (C) Jean François Micouleau      1998-2000.
+ *  Copyright (C) Jeremy Allison                                       2001.
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -39,14 +39,9 @@ extern pstring global_myname;
 /* and the notify info asked about */
 /* that's the central struct */
 typedef struct _Printer{
-       ubi_dlNode Next;
-       ubi_dlNode Prev;
-
-       BOOL open;
        BOOL document_started;
        BOOL page_started;
-       int jobid; /* jobid in printing backend */
-       POLICY_HND printer_hnd;
+    int jobid; /* jobid in printing backend */
        BOOL printer_type;
        union {
                fstring handlename;
@@ -77,25 +72,41 @@ typedef struct _counter_printer_0 {
        uint32 counter;
 } counter_printer_0;
 
-static ubi_dlList Printer_list;
 static ubi_dlList counter_list;
 
 static struct cli_state cli;
 static uint32 smb_connections=0;
 
-#define OPEN_HANDLE(pnum)    ((pnum!=NULL) && (pnum->open!=False) && (IVAL(pnum->printer_hnd.data,16)==(uint32)sys_getpid()))
-#define OUR_HANDLE(pnum) ((pnum==NULL)?"NULL":(IVAL(pnum->data,16)==sys_getpid()?"OURS":"OTHER"))
+#define OUR_HANDLE(hnd) ((hnd==NULL)?"NULL":(IVAL(hnd->data5,4)==(uint32)sys_getpid()?"OURS":"OTHER"))
 
 /* translate between internal status numbers and NT status numbers */
 static int nt_printj_status(int v)
 {
        switch (v) {
-       case LPQ_PAUSED:
-               return PRINTER_STATUS_PAUSED;
        case LPQ_QUEUED:
+               return 0;
+       case LPQ_PAUSED:
+               return JOB_STATUS_PAUSED;
        case LPQ_SPOOLING:
+               return JOB_STATUS_SPOOLING;
        case LPQ_PRINTING:
-               return 0;
+               return JOB_STATUS_PRINTING;
+       case LPQ_ERROR:
+               return JOB_STATUS_ERROR;
+       case LPQ_DELETING:
+               return JOB_STATUS_DELETING;
+       case LPQ_OFFLINE:
+               return JOB_STATUS_OFFLINE;
+       case LPQ_PAPEROUT:
+               return JOB_STATUS_PAPEROUT;
+       case LPQ_PRINTED:
+               return JOB_STATUS_PRINTED;
+       case LPQ_DELETED:
+               return JOB_STATUS_DELETED;
+       case LPQ_BLOCKED:
+               return JOB_STATUS_BLOCKED;
+       case LPQ_USER_INTERVENTION:
+               return JOB_STATUS_USER_INTERVENTION;
        }
        return 0;
 }
@@ -114,125 +125,149 @@ static int nt_printq_status(int v)
 }
 
 /****************************************************************************
 initialise printer handle states...
Functions to handle SPOOL_NOTIFY_OPTION struct stored in Printer_entry.
 ****************************************************************************/
-void init_printer_hnd(void)
-{
-       ubi_dlInitList(&Printer_list);
-       ubi_dlInitList(&counter_list);
-}
 
-/****************************************************************************
-  create a unique printer handle
-****************************************************************************/
-static void create_printer_hnd(POLICY_HND *hnd)
+static void free_spool_notify_option(SPOOL_NOTIFY_OPTION **pp)
 {
-       static uint32 prt_hnd_low  = 0;
-       static uint32 prt_hnd_high = 0;
+       SPOOL_NOTIFY_OPTION *sp = *pp;
 
-       if (hnd == NULL) return;
+       *pp = NULL;
 
-       /* i severely doubt that prt_hnd_high will ever be non-zero... */
-       prt_hnd_low++;
-       if (prt_hnd_low == 0) prt_hnd_high++;
-
-       SIVAL(hnd->data, 0 , 0x0);          /* first bit must be null */
-       SIVAL(hnd->data, 4 , prt_hnd_low ); /* second bit is incrementing */
-       SIVAL(hnd->data, 8 , prt_hnd_high); /* second bit is incrementing */
-       SIVAL(hnd->data, 12, time(NULL));   /* something random */
-       SIVAL(hnd->data, 16, sys_getpid());     /* something more random */
-}
-
-/****************************************************************************
-  find printer index by handle
-****************************************************************************/
-static Printer_entry *find_printer_index_by_hnd(const POLICY_HND *hnd)
-{
-       Printer_entry *find_printer;
-
-       find_printer = (Printer_entry *)ubi_dlFirst(&Printer_list);
+       if (!sp)
+               return;
 
-       for(; find_printer; find_printer = (Printer_entry *)ubi_dlNext(find_printer)) {
+       if (sp->ctr.type)
+               safe_free(sp->ctr.type);
 
-               if (memcmp(&(find_printer->printer_hnd), hnd, sizeof(*hnd)) == 0) {
-                       DEBUG(4,("Found printer handle \n"));
-                       /*dump_data(4, hnd->data, sizeof(hnd->data));*/
-                       return find_printer;
-               }
-       }
-       
-       DEBUG(3,("Whoops, Printer handle not found: "));
-       /*dump_data(4, hnd->data, sizeof(hnd->data));*/
-       return NULL;
-}
-
-/****************************************************************************
-  clear an handle
-****************************************************************************/
-static void clear_handle(POLICY_HND *hnd)
-{
-       ZERO_STRUCTP(hnd);
+       free(sp);
 }
 
 /***************************************************************************
  Disconnect from the client
 ****************************************************************************/
-static BOOL srv_spoolss_replycloseprinter(POLICY_HND *handle)
+
+static void srv_spoolss_replycloseprinter(POLICY_HND *handle)
 {
        uint32 status;
 
        /* weird if the test succeds !!! */
        if (smb_connections==0) {
                DEBUG(0,("srv_spoolss_replycloseprinter:Trying to close non-existant notify backchannel !\n"));
-               return False;
+               return;
        }
 
        if(!cli_spoolss_reply_close_printer(&cli, handle, &status))
-               return False;
+               DEBUG(0,("srv_spoolss_replycloseprinter: reply_close_printer failed.\n"));
 
        /* if it's the last connection, deconnect the IPC$ share */
        if (smb_connections==1) {
                if(!spoolss_disconnect_from_client(&cli))
-                       return False;
+                       return;
 
                message_deregister(MSG_PRINTER_NOTIFY);
        }
 
        smb_connections--;
-
-       return True;
 }
 
 /****************************************************************************
-  close printer index by handle
+ Functions to free a printer entry datastruct.
 ****************************************************************************/
-static BOOL close_printer_handle(POLICY_HND *hnd)
-{
-       Printer_entry *Printer = find_printer_index_by_hnd(hnd);
 
-       if (!OPEN_HANDLE(Printer)) {
-               DEBUG(0,("close_printer_handle: Invalid handle (%s)\n", OUR_HANDLE(hnd)));
-               return False;
-       }
+static void free_printer_entry(void *ptr)
+{
+       Printer_entry *Printer = (Printer_entry *)ptr;
 
        if (Printer->notify.client_connected==True)
-               if(!srv_spoolss_replycloseprinter(&Printer->notify.client_hnd))
-                       return ERROR_INVALID_HANDLE;
+               srv_spoolss_replycloseprinter(&Printer->notify.client_hnd);
 
-       Printer->open=False;
        Printer->notify.flags=0;
        Printer->notify.options=0;
        Printer->notify.localmachine[0]='\0';
        Printer->notify.printerlocal=0;
-       safe_free(Printer->notify.option);
+       free_spool_notify_option(&Printer->notify.option);
        Printer->notify.option=NULL;
        Printer->notify.client_connected=False;
 
-       clear_handle(hnd);
+       safe_free(Printer);
+}
+
+/****************************************************************************
+ Functions to duplicate a SPOOL_NOTIFY_OPTION struct stored in Printer_entry.
+****************************************************************************/
 
-       ubi_dlRemThis(&Printer_list, Printer);
+SPOOL_NOTIFY_OPTION *dup_spool_notify_option(SPOOL_NOTIFY_OPTION *sp)
+{
+       SPOOL_NOTIFY_OPTION *new_sp = NULL;
 
-       safe_free(Printer);
+       if (!sp)
+               return NULL;
+
+       new_sp = (SPOOL_NOTIFY_OPTION *)malloc(sizeof(SPOOL_NOTIFY_OPTION));
+       if (!new_sp)
+               return NULL;
+
+       *new_sp = *sp;
+
+       if (sp->ctr.count) {
+               new_sp->ctr.type = (SPOOL_NOTIFY_OPTION_TYPE *)memdup(sp->ctr.type, sizeof(SPOOL_NOTIFY_OPTION_TYPE) * sp->ctr.count);
+
+               if (!new_sp->ctr.type) {
+                       safe_free(new_sp);
+                       return NULL;
+               }
+       }
+
+       return new_sp;
+}
+
+/****************************************************************************
+ Return a user struct for a pipe user.
+****************************************************************************/
+
+static struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
+{
+       if (p->ntlmssp_auth_validated) {
+               memcpy(user, &p->pipe_user, sizeof(struct current_user));
+       } else {
+               extern struct current_user current_user;
+               memcpy(user, &current_user, sizeof(struct current_user));
+       }
+
+       return user;
+}
+
+/****************************************************************************
+  find printer index by handle
+****************************************************************************/
+
+static Printer_entry *find_printer_index_by_hnd(pipes_struct *p, POLICY_HND *hnd)
+{
+       Printer_entry *find_printer = NULL;
+
+       if(!find_policy_by_hnd(p,hnd,(void **)&find_printer)) {
+               DEBUG(3,("find_printer_index_by_hnd: Printer handle not found: "));
+               return NULL;
+       }
+
+       return find_printer;
+}
+
+/****************************************************************************
+  close printer index by handle
+****************************************************************************/
+
+static BOOL close_printer_handle(pipes_struct *p, POLICY_HND *hnd)
+{
+       Printer_entry *Printer = find_printer_index_by_hnd(p, hnd);
+
+       if (!Printer) {
+               DEBUG(0,("close_printer_handle: Invalid handle (%s)\n", OUR_HANDLE(hnd)));
+               return False;
+       }
+
+       close_policy_hnd(p, hnd);
 
        return True;
 }      
@@ -240,18 +275,28 @@ static BOOL close_printer_handle(POLICY_HND *hnd)
 /****************************************************************************
   delete a printer given a handle
 ****************************************************************************/
-static BOOL delete_printer_handle(POLICY_HND *hnd)
+static uint32 delete_printer_handle(pipes_struct *p, POLICY_HND *hnd)
 {
-       Printer_entry *Printer = find_printer_index_by_hnd(hnd);
+       Printer_entry *Printer = find_printer_index_by_hnd(p, hnd);
 
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("delete_printer_handle: Invalid handle (%s)\n", OUR_HANDLE(hnd)));
-               return False;
+               return ERROR_INVALID_HANDLE;
        }
 
        if (del_a_printer(Printer->dev.handlename) != 0) {
                DEBUG(3,("Error deleting printer %s\n", Printer->dev.handlename));
-               return False;
+               return ERROR_INVALID_HANDLE;
+       }
+
+       /* Check calling user has permission to delete printer.  Note that
+          since we set the snum parameter to -1 only administrators can
+          delete the printer.  This stops people with the Full Control
+          permission from deleting the printer. */
+
+       if (!print_access_check(NULL, -1, PRINTER_ACCESS_ADMINISTER)) {
+               DEBUG(3, ("printer delete denied by security descriptor\n"));
+               return ERROR_ACCESS_DENIED;
        }
 
        if (*lp_deleteprinter_cmd()) {
@@ -270,16 +315,17 @@ static BOOL delete_printer_handle(POLICY_HND *hnd)
                        path = tmpdir();
                
                /* Printer->dev.handlename equals portname equals sharename */
-               slprintf(command, sizeof(command), "%s \"%s\"", cmd,
+               slprintf(command, sizeof(command)-1, "%s \"%s\"", cmd,
                                        Printer->dev.handlename);
-               slprintf(tmp_file, sizeof(tmp_file), "%s/smbcmd.%d", path, local_pid);
+               dos_to_unix(command, True);  /* Convert printername to unix-codepage */
+        slprintf(tmp_file, sizeof(tmp_file)-1, "%s/smbcmd.%d", path, local_pid);
 
                unlink(tmp_file);
                DEBUG(10,("Running [%s > %s]\n", command,tmp_file));
                ret = smbrun(command, tmp_file, False);
                if (ret != 0) {
                        unlink(tmp_file);
-                       return False;
+                       return ERROR_INVALID_HANDLE; /* What to return here? */
                }
                DEBUGADD(10,("returned [%d]\n", ret));
                DEBUGADD(10,("Unlinking output file [%s]\n", tmp_file));
@@ -289,24 +335,23 @@ static BOOL delete_printer_handle(POLICY_HND *hnd)
                kill(0, SIGHUP);
 
                if ( ( i = lp_servicenumber( Printer->dev.handlename ) ) >= 0 ) {
-                       lp_remove_service( i );
                        lp_killservice( i );
-                       return True;
+                       return ERROR_SUCCESS;
                } else
-                       return False;
+                       return ERROR_ACCESS_DENIED;
        }
 
-       return True;
+       return ERROR_SUCCESS;
 }      
 
 /****************************************************************************
   return the snum of a printer corresponding to an handle
 ****************************************************************************/
-static BOOL get_printer_snum(POLICY_HND *hnd, int *number)
+static BOOL get_printer_snum(pipes_struct *p, POLICY_HND *hnd, int *number)
 {
-       Printer_entry *Printer = find_printer_index_by_hnd(hnd);
+       Printer_entry *Printer = find_printer_index_by_hnd(p, hnd);
                
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("get_printer_snum: Invalid handle (%s)\n", OUR_HANDLE(hnd)));
                return False;
        }
@@ -326,11 +371,11 @@ static BOOL get_printer_snum(POLICY_HND *hnd, int *number)
 /****************************************************************************
   set printer handle type.
 ****************************************************************************/
-static BOOL set_printer_hnd_accesstype(POLICY_HND *hnd, uint32 access_required)
+static BOOL set_printer_hnd_accesstype(pipes_struct *p, POLICY_HND *hnd, uint32 access_required)
 {
-       Printer_entry *Printer = find_printer_index_by_hnd(hnd);
+       Printer_entry *Printer = find_printer_index_by_hnd(p, hnd);
 
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("set_printer_hnd_accesstype: Invalid handle (%s)", OUR_HANDLE(hnd)));
                return False;
        }
@@ -496,47 +541,48 @@ static BOOL set_printer_hnd_name(Printer_entry *Printer, char *handlename)
   find first available printer slot. creates a printer handle for you.
  ****************************************************************************/
 
-static BOOL open_printer_hnd(POLICY_HND *hnd, char *name)
+static BOOL open_printer_hnd(pipes_struct *p, POLICY_HND *hnd, char *name)
 {
        Printer_entry *new_printer;
 
        DEBUG(10,("open_printer_hnd: name [%s]\n", name));
-       clear_handle(hnd);
-       create_printer_hnd(hnd);
 
        if((new_printer=(Printer_entry *)malloc(sizeof(Printer_entry))) == NULL)
                return False;
 
        ZERO_STRUCTP(new_printer);
        
-       new_printer->open = True;
        new_printer->notify.option=NULL;
                                
-       memcpy(&new_printer->printer_hnd, hnd, sizeof(*hnd));
-       
-       ubi_dlAddHead( &Printer_list, (ubi_dlNode *)new_printer);
+       if (!create_policy_hnd(p, hnd, free_printer_entry, new_printer)) {
+               safe_free(new_printer);
+               return False;
+       }
 
        if (!set_printer_hnd_printertype(new_printer, name)) {
-               close_printer_handle(hnd);
+               close_printer_handle(p, hnd);
                return False;
        }
        
        if (!set_printer_hnd_name(new_printer, name)) {
-               close_printer_handle(hnd);
+               close_printer_handle(p, hnd);
                return False;
        }
 
+       DEBUG(5, ("%d printer handles active\n", (int)p->pipe_handles.count ));
+
        return True;
 }
 
 /********************************************************************
  Return True is the handle is a print server.
  ********************************************************************/
-static BOOL handle_is_printserver(const POLICY_HND *handle)
+
+static BOOL handle_is_printserver(pipes_struct *p, POLICY_HND *handle)
 {
-       Printer_entry *Printer=find_printer_index_by_hnd(handle);
+       Printer_entry *Printer=find_printer_index_by_hnd(p,handle);
 
-       if (!OPEN_HANDLE(Printer))
+       if (!Printer)
                return False;
                
        if (Printer->printer_type != PRINTER_HANDLE_IS_PRINTSERVER)
@@ -582,11 +628,12 @@ static BOOL alloc_buffer_size(NEW_BUFFER *buffer, uint32 buffer_size)
 /***************************************************************************
  receive the notify message
 ****************************************************************************/
+
 void srv_spoolss_receive_message(int msg_type, pid_t src, void *buf, size_t len)
 {
        fstring printer;
        uint32 status;
-       Printer_entry *find_printer;
+       struct pipes_struct *p;
 
        *printer = '\0';
        fstrcpy(printer,buf);
@@ -598,36 +645,45 @@ void srv_spoolss_receive_message(int msg_type, pid_t src, void *buf, size_t len)
 
        DEBUG(10,("srv_spoolss_receive_message: Got message about printer %s\n", printer ));
 
-       find_printer = (Printer_entry *)ubi_dlFirst(&Printer_list);
+       /* We need to enumerate all our pipes and all printers on them. */
+       for ( p = get_first_pipe(); p; get_next_pipe(p)) {
+               struct policy *pol;
 
-       /* Iterate the printer list. */
-       for(; find_printer; find_printer = (Printer_entry *)ubi_dlNext(find_printer)) {
+               if (!strequal(p->name, "spoolss"))
+                       continue;
 
-               /*
-                * if the entry is the given printer or if it's a printerserver
-                * we send the message
-                */
+               /* Iterate the printer list on this pipe. */
+               for (pol = p->pipe_handles.Policy; pol; pol = pol->next ) {
+                       Printer_entry *find_printer = (Printer_entry *)pol->data_ptr;
 
-               if (find_printer->printer_type==PRINTER_HANDLE_IS_PRINTER)
-                       if (strcmp(find_printer->dev.handlename, printer))
+                       if (!find_printer)
                                continue;
 
-               if (find_printer->notify.client_connected==True)
-                       cli_spoolss_reply_rrpcn(&cli, &find_printer->notify.client_hnd, PRINTER_CHANGE_ALL, 0x0, &status);
+                       /*
+                        * if the entry is the given printer or if it's a printerserver
+                        * we send the message
+                        */
 
+                       if (find_printer->printer_type==PRINTER_HANDLE_IS_PRINTER)
+                               if (strcmp(find_printer->dev.handlename, printer))
+                                       continue;
+
+                       if (find_printer->notify.client_connected==True)
+                               cli_spoolss_reply_rrpcn(&cli, &find_printer->notify.client_hnd, PRINTER_CHANGE_ALL, 0x0, &status);
+               }
        }
 }
 
 /***************************************************************************
  send a notify event
 ****************************************************************************/
-static BOOL srv_spoolss_sendnotify(POLICY_HND *handle)
+static BOOL srv_spoolss_sendnotify(pipes_struct *p, POLICY_HND *handle)
 {
        fstring printer;
 
-       Printer_entry *Printer=find_printer_index_by_hnd(handle);
+       Printer_entry *Printer=find_printer_index_by_hnd(p, handle);
 
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("srv_spoolss_sendnotify: Invalid handle (%s).\n", OUR_HANDLE(handle)));
                return False;
        }
@@ -650,13 +706,26 @@ static BOOL srv_spoolss_sendnotify(POLICY_HND *handle)
  *
  * called from the spoolss dispatcher
  ********************************************************************/
-uint32 _spoolss_open_printer_ex( const UNISTR2 *printername,
-                                const PRINTER_DEFAULT *printer_default,
-                                uint32  user_switch, SPOOL_USER_CTR user_ctr,
-                                POLICY_HND *handle)
+
+uint32 _spoolss_open_printer_ex( pipes_struct *p, SPOOL_Q_OPEN_PRINTER_EX *q_u, SPOOL_R_OPEN_PRINTER_EX *r_u)
 {
+#if 0
+       uint32 result = NT_STATUS_NO_PROBLEMO;
+#endif
+
+       UNISTR2 *printername = NULL;
+       PRINTER_DEFAULT *printer_default = &q_u->printer_default;
+/*     uint32 user_switch = q_u->user_switch; - notused */
+/*     SPOOL_USER_CTR user_ctr = q_u->user_ctr; - notused */
+       POLICY_HND *handle = &r_u->handle;
+
        fstring name;
-       
+       int snum;
+       struct current_user user;
+
+       if (q_u->printername_ptr != 0)
+               printername = &q_u->printername;
+
        if (printername == NULL)
                return ERROR_INVALID_PRINTER_NAME;
 
@@ -666,7 +735,7 @@ uint32 _spoolss_open_printer_ex( const UNISTR2 *printername,
 
        DEBUGADD(3,("checking name: %s\n",name));
 
-       if (!open_printer_hnd(handle, name))
+       if (!open_printer_hnd(p, handle, name))
                return ERROR_INVALID_PRINTER_NAME;
        
 /*
@@ -679,27 +748,150 @@ uint32 _spoolss_open_printer_ex( const UNISTR2 *printername,
                set_printer_hnd_datatype(handle, "");
 */
        
-       if (!set_printer_hnd_accesstype(handle, printer_default->access_required)) {
-               close_printer_handle(handle);
+       if (!set_printer_hnd_accesstype(p, handle, printer_default->access_required)) {
+               close_printer_handle(p, handle);
                return ERROR_ACCESS_DENIED;
        }
                
-       /* Disallow MS AddPrinterWizard if parameter disables it. A Win2k
+       /*
+          First case: the user is opening the print server:
+
+          Disallow MS AddPrinterWizard if parameter disables it. A Win2k
           client 1st tries an OpenPrinterEx with access==0, MUST be allowed.
+
           Then both Win2k and WinNT clients try an OpenPrinterEx with
-          SERVER_ALL_ACCESS, which we force to fail. Then they try
-          OpenPrinterEx with SERVER_READ which we allow. This lets the
+          SERVER_ALL_ACCESS, which we allow only if the user is root (uid=0)
+          or if the user is listed in the smb.conf printer admin parameter.
+
+          Then they try OpenPrinterEx with SERVER_READ which we allow. This lets the
           client view printer folder, but does not show the MSAPW.
 
           Note: this test needs code to check access rights here too. Jeremy
-          could you look at this? */
+          could you look at this?
+          
+          
+          Second case: the user is opening a printer:
+          NT doesn't let us connect to a printer if the connecting user
+          doesn't have print permission.
 
-       if (handle_is_printserver(handle) &&
-           !lp_ms_add_printer_wizard()) {
-               if (printer_default->access_required == 0)
+       */
+
+       get_current_user(&user, p);
+
+       if (handle_is_printserver(p, handle)) {
+               if (printer_default->access_required == 0) {
                        return NT_STATUS_NO_PROBLEMO;
-               else if (printer_default->access_required != (SERVER_READ))
-               return ERROR_ACCESS_DENIED;
+               }
+               else if ((printer_default->access_required & SERVER_ACCESS_ADMINISTER ) == SERVER_ACCESS_ADMINISTER) {
+
+                       /* Printserver handles use global struct... */
+                       snum = -1;
+
+                       if (!lp_ms_add_printer_wizard()) {
+                               close_printer_handle(p, handle);
+                               return ERROR_ACCESS_DENIED;
+                       }
+                       else if (user.uid == 0 || user_in_list(uidtoname(user.uid), lp_printer_admin(snum))) {
+                               return NT_STATUS_NO_PROBLEMO;
+                       } 
+                       else {
+                               close_printer_handle(p, handle);
+                               return ERROR_ACCESS_DENIED;
+                       }
+               }
+       }
+       else
+       {
+               /* NT doesn't let us connect to a printer if the connecting user
+                  doesn't have print permission.  */
+
+               if (!get_printer_snum(p, handle, &snum))
+                       return ERROR_INVALID_HANDLE;
+
+               /* map an empty access mask to the minimum access mask */
+               if (printer_default->access_required == 0x0)
+                       printer_default->access_required = PRINTER_ACCESS_USE;
+
+               if (!print_access_check(&user, snum, printer_default->access_required)) {
+                       DEBUG(3, ("access DENIED for printer open\n"));
+                       close_printer_handle(p, handle);
+                       return ERROR_ACCESS_DENIED;
+               }
+
+               /*
+                * If we have a default device pointer in the
+                * printer_default struct, then we need to get
+                * the printer info from the tdb and if there is
+                * no default devicemode there then we do a *SET*
+                * here ! This is insanity.... JRA.
+                */
+
+               /*
+                * If the openprinterex rpc call contains a devmode,
+                * it's a per-user one. This per-user devmode is derivated
+                * from the global devmode. Openprinterex() contains a per-user 
+                * devmode for when you do EMF printing and spooling.
+                * In the EMF case, the NT workstation is only doing half the job
+                * of rendering the page. The other half is done by running the printer
+                * driver on the server.
+                * The EMF file doesn't contain the page description (paper size, orientation, ...).
+                * The EMF file only contains what is to be printed on the page.
+                * So in order for the server to know how to print, the NT client sends
+                * a devicemode attached to the openprinterex call.
+                * But this devicemode is short lived, it's only valid for the current print job.
+                *
+                * If Samba would have supported EMF spooling, this devicemode would
+                * have been attached to the handle, to sent it to the driver to correctly
+                * rasterize the EMF file.
+                *
+                * As Samba only supports RAW spooling, we only receive a ready-to-print file,
+                * we just act as a pass-thru between windows and the printer.
+                *
+                * In order to know that Samba supports only RAW spooling, NT has to call
+                * getprinter() at level 2 (attribute field) or NT has to call startdoc()
+                * and until NT sends a RAW job, we refuse it.
+                *
+                * But to call getprinter() or startdoc(), you first need a valid handle,
+                * and to get an handle you have to call openprintex(). Hence why you have
+                * a devicemode in the openprinterex() call.
+                *
+                *
+                * Differences between NT4 and NT 2000.
+                * NT4:
+                * ---
+                * On NT4, you only have a global devicemode. This global devicemode can be changed
+                * by the administrator (or by a user with enough privs). Everytime a user
+                * wants to print, the devicemode is resetted to the default. In Word, everytime
+                * you print, the printer's characteristics are always reset to the global devicemode.
+                *
+                * NT 2000:
+                * -------
+                * In W2K, there is the notion of per-user devicemode. The first time you use
+                * a printer, a per-user devicemode is build from the global devicemode.
+                * If you change your per-user devicemode, it is saved in the registry, under the
+                * H_KEY_CURRENT_KEY sub_tree. So that everytime you print, you have your default
+                * printer preferences available.
+                *
+                * To change the per-user devicemode: it's the "Printing Preferences ..." button
+                * on the General Tab of the printer properties windows.
+                *
+                * To change the global devicemode: it's the "Printing Defaults..." button
+                * on the Advanced Tab of the printer properties window.
+                *
+                * JFM.
+                */
+
+
+
+#if 0
+               if (printer_default->devmode_cont.devmode != NULL) {
+                       result = printer_write_default_dev( snum, printer_default);
+                       if (result != 0) {
+                               close_printer_handle(p, handle);
+                               return result;
+                       }
+               }
+#endif
        }
 
        return NT_STATUS_NO_PROBLEMO;
@@ -740,15 +932,28 @@ static BOOL convert_printer_driver_info(const SPOOL_PRINTER_DRIVER_INFO_LEVEL *u
        return True;
 }
 
-static BOOL convert_devicemode(const DEVICEMODE *devmode, NT_DEVICEMODE *nt_devmode)
+BOOL convert_devicemode(char *printername, const DEVICEMODE *devmode,
+                               NT_DEVICEMODE **pp_nt_devmode)
 {
+       NT_DEVICEMODE *nt_devmode = *pp_nt_devmode;
+
+       /*
+        * Ensure nt_devmode is a valid pointer
+        * as we will be overwriting it.
+        */
+               
+       if (nt_devmode == NULL) {
+               DEBUG(5, ("convert_devicemode: allocating a generic devmode\n"));
+               if ((nt_devmode = construct_nt_devicemode(printername)) == NULL)
+                       return False;
+       }
+
        unistr_to_dos(nt_devmode->devicename, (const char *)devmode->devicename.buffer, 31);
        unistr_to_dos(nt_devmode->formname, (const char *)devmode->formname.buffer, 31);
 
        nt_devmode->specversion=devmode->specversion;
        nt_devmode->driverversion=devmode->driverversion;
        nt_devmode->size=devmode->size;
-       nt_devmode->driverextra=devmode->driverextra;
        nt_devmode->fields=devmode->fields;
        nt_devmode->orientation=devmode->orientation;
        nt_devmode->papersize=devmode->papersize;
@@ -779,31 +984,60 @@ static BOOL convert_devicemode(const DEVICEMODE *devmode, NT_DEVICEMODE *nt_devm
        nt_devmode->panningwidth=devmode->panningwidth;
        nt_devmode->panningheight=devmode->panningheight;
 
-       safe_free(nt_devmode->private);
-       if (nt_devmode->driverextra != 0) {
-               /* if we had a previous private delete it and make a new one */
+       /*
+        * Only change private and driverextra if the incoming devmode
+        * has a new one. JRA.
+        */
+
+       if ((devmode->driverextra != 0) && (devmode->private != NULL)) {
+               safe_free(nt_devmode->private);
+               nt_devmode->driverextra=devmode->driverextra;
                if((nt_devmode->private=(uint8 *)malloc(nt_devmode->driverextra * sizeof(uint8))) == NULL)
                        return False;
                memcpy(nt_devmode->private, devmode->private, nt_devmode->driverextra);
        }
-       else {
-               nt_devmode->private = NULL;
-       }
+
+       *pp_nt_devmode = nt_devmode;
 
        return True;
 }
 
+/********************************************************************
+ * _spoolss_enddocprinter_internal.
+ ********************************************************************/
+
+static uint32 _spoolss_enddocprinter_internal(pipes_struct *p, POLICY_HND *handle)
+{
+       Printer_entry *Printer=find_printer_index_by_hnd(p, handle);
+       
+       if (!Printer) {
+               DEBUG(0,("_spoolss_enddocprinter_internal: Invalid handle (%s)\n", OUR_HANDLE(handle)));
+               return ERROR_INVALID_HANDLE;
+       }
+       
+       Printer->document_started=False;
+       print_job_end(Printer->jobid,True);
+       /* error codes unhandled so far ... */
+
+       return 0x0;
+}
+
 /********************************************************************
  * api_spoolss_closeprinter
  ********************************************************************/
-uint32 _spoolss_closeprinter(POLICY_HND *handle)
+
+uint32 _spoolss_closeprinter(pipes_struct *p, SPOOL_Q_CLOSEPRINTER *q_u, SPOOL_R_CLOSEPRINTER *r_u)
 {
-       Printer_entry *Printer=find_printer_index_by_hnd(handle);
+       POLICY_HND *handle = &q_u->handle;
+
+       Printer_entry *Printer=find_printer_index_by_hnd(p, handle);
 
        if (Printer && Printer->document_started)
-               _spoolss_enddocprinter(handle);          /* print job was not closed */
+               _spoolss_enddocprinter_internal(p, handle);          /* print job was not closed */
 
-       if (!close_printer_handle(handle))
+       memcpy(&r_u->handle, &q_u->handle, sizeof(r_u->handle));
+
+       if (!close_printer_handle(p, handle))
                return ERROR_INVALID_HANDLE;    
                
        return NT_STATUS_NO_PROBLEMO;
@@ -811,26 +1045,34 @@ uint32 _spoolss_closeprinter(POLICY_HND *handle)
 
 /********************************************************************
  * api_spoolss_deleteprinter
+
  ********************************************************************/
-uint32 _spoolss_deleteprinter(POLICY_HND *handle)
+
+uint32 _spoolss_deleteprinter(pipes_struct *p, SPOOL_Q_DELETEPRINTER *q_u, SPOOL_R_DELETEPRINTER *r_u)
 {
-       Printer_entry *Printer=find_printer_index_by_hnd(handle);
+       POLICY_HND *handle = &q_u->handle;
+
+       Printer_entry *Printer=find_printer_index_by_hnd(p, handle);
+       uint32 result;
 
        if (Printer && Printer->document_started)
-               _spoolss_enddocprinter(handle);          /* print job was not closed */
+               _spoolss_enddocprinter_internal(p, handle);  /* print job was not closed */
 
-       if (!delete_printer_handle(handle))
-               return ERROR_INVALID_HANDLE;    
+       memcpy(&r_u->handle, &q_u->handle, sizeof(r_u->handle));
 
-       srv_spoolss_sendnotify(handle);
+       result = delete_printer_handle(p, handle);
+
+       if (result == ERROR_SUCCESS) {
+               srv_spoolss_sendnotify(p, handle);
+       }
                
-       return NT_STATUS_NO_PROBLEMO;
+       return result;
 }
 
 /********************************************************************
  GetPrinterData on a printer server Handle.
 ********************************************************************/
-static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **data, uint32 *needed, uint32 in_size)
+static BOOL getprinterdata_printer_server(TALLOC_CTX *ctx, fstring value, uint32 *type, uint8 **data, uint32 *needed, uint32 in_size)
 {              
        int i;
        
@@ -838,7 +1080,7 @@ static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **d
                
        if (!strcmp(value, "BeepEnabled")) {
                *type = 0x4;
-               if((*data = (uint8 *)malloc( 4*sizeof(uint8) )) == NULL)
+               if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
                        return False;
                SIVAL(*data, 0, 0x01);
                *needed = 0x4;                  
@@ -847,7 +1089,7 @@ static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **d
 
        if (!strcmp(value, "EventLog")) {
                *type = 0x4;
-               if((*data = (uint8 *)malloc( 4*sizeof(uint8) )) == NULL)
+               if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
                        return False;
                SIVAL(*data, 0, 0x1B);
                *needed = 0x4;                  
@@ -856,7 +1098,7 @@ static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **d
 
        if (!strcmp(value, "NetPopup")) {
                *type = 0x4;
-               if((*data = (uint8 *)malloc( 4*sizeof(uint8) )) == NULL)
+               if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
                        return False;
                SIVAL(*data, 0, 0x01);
                *needed = 0x4;
@@ -865,18 +1107,18 @@ static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **d
 
        if (!strcmp(value, "MajorVersion")) {
                *type = 0x4;
-               if((*data = (uint8 *)malloc( 4*sizeof(uint8) )) == NULL)
+               if((*data = (uint8 *)talloc(ctx, 4*sizeof(uint8) )) == NULL)
                        return False;
                SIVAL(*data, 0, 0x02);
                *needed = 0x4;
                return True;
        }
 
-       if (!strcmp(value, "DefaultSpoolDirectory")) {
+   if (!strcmp(value, "DefaultSpoolDirectory")) {
                pstring string="You are using a Samba server";
                *type = 0x1;                    
                *needed = 2*(strlen(string)+1);         
-               if((*data  = (uint8 *)malloc( ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
+               if((*data  = (uint8 *)talloc(ctx, ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
                        return False;
                memset(*data, 0, (*needed > in_size) ? *needed:in_size);
                
@@ -892,7 +1134,7 @@ static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **d
                pstring string="Windows NT x86";
                *type = 0x1;                    
                *needed = 2*(strlen(string)+1); 
-               if((*data  = (uint8 *)malloc( ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
+               if((*data  = (uint8 *)talloc(ctx, ((*needed > in_size) ? *needed:in_size) *sizeof(uint8))) == NULL)
                        return False;
                memset(*data, 0, (*needed > in_size) ? *needed:in_size);
                for (i=0; i<strlen(string); i++) {
@@ -908,7 +1150,7 @@ static BOOL getprinterdata_printer_server(fstring value, uint32 *type, uint8 **d
 /********************************************************************
  GetPrinterData on a printer Handle.
 ********************************************************************/
-static BOOL getprinterdata_printer(POLICY_HND *handle,
+static BOOL getprinterdata_printer(pipes_struct *p, TALLOC_CTX *ctx, POLICY_HND *handle,
                                fstring value, uint32 *type,
                                uint8 **data, uint32 *needed, uint32 in_size )
 {
@@ -916,16 +1158,16 @@ static BOOL getprinterdata_printer(POLICY_HND *handle,
        int snum=0;
        uint8 *idata=NULL;
        uint32 len;
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
        
        DEBUG(5,("getprinterdata_printer\n"));
 
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("getprinterdata_printer: Invalid handle (%s).\n", OUR_HANDLE(handle)));
                return False;
        }
 
-       if(!get_printer_snum(handle, &snum))
+       if(!get_printer_snum(p, handle, &snum))
                return False;
 
        if(get_a_printer(&printer, 2, lp_servicename(snum)) != 0)
@@ -941,7 +1183,7 @@ static BOOL getprinterdata_printer(POLICY_HND *handle,
        DEBUG(5,("getprinterdata_printer:allocating %d\n", in_size));
 
        if (in_size) {
-               if((*data  = (uint8 *)malloc( in_size *sizeof(uint8) )) == NULL) {
+               if((*data  = (uint8 *)talloc(ctx, in_size *sizeof(uint8) )) == NULL) {
                        return False;
                }
 
@@ -964,16 +1206,20 @@ static BOOL getprinterdata_printer(POLICY_HND *handle,
 /********************************************************************
  * spoolss_getprinterdata
  ********************************************************************/
-uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
-                               uint32 in_size,
-                               uint32 *type,
-                               uint32 *out_size,
-                               uint8 **data,
-                               uint32 *needed)
+
+uint32 _spoolss_getprinterdata(pipes_struct *p, SPOOL_Q_GETPRINTERDATA *q_u, SPOOL_R_GETPRINTERDATA *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+       UNISTR2 *valuename = &q_u->valuename;
+       uint32 in_size = q_u->size;
+       uint32 *type = &r_u->type;
+       uint32 *out_size = &r_u->size;
+       uint8 **data = &r_u->data;
+       uint32 *needed = &r_u->needed;
+
        fstring value;
        BOOL found=False;
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
        
        /*
         * Reminder: when it's a string, the length is in BYTES
@@ -990,7 +1236,7 @@ uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
        
        DEBUG(4,("_spoolss_getprinterdata\n"));
        
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                if((*data=(uint8 *)malloc(4*sizeof(uint8))) == NULL)
                        return ERROR_NOT_ENOUGH_MEMORY;
                DEBUG(0,("_spoolss_getprinterdata: Invalid handle (%s).\n", OUR_HANDLE(handle)));
@@ -999,18 +1245,17 @@ uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
        
        unistr2_to_ascii(value, valuename, sizeof(value)-1);
        
-       if (handle_is_printserver(handle))
-               found=getprinterdata_printer_server(value, type, data, needed, *out_size);
+       if (Printer->printer_type == PRINTER_HANDLE_IS_PRINTSERVER)
+               found=getprinterdata_printer_server(p->mem_ctx, value, type, data, needed, *out_size);
        else
-               found=getprinterdata_printer(handle, value, type, data, needed, *out_size);
+               found= getprinterdata_printer(p, p->mem_ctx, handle, value, type, data, needed, *out_size);
 
        if (found==False) {
                DEBUG(5, ("value not found, allocating %d\n", *out_size));
                /* reply this param doesn't exist */
                if (*out_size) {
-                       if((*data=(uint8 *)malloc(*out_size*sizeof(uint8))) == NULL)
+                       if((*data=(uint8 *)talloc_zero(p->mem_ctx, *out_size*sizeof(uint8))) == NULL)
                                return ERROR_NOT_ENOUGH_MEMORY;
-                       memset(*data, '\0', *out_size*sizeof(uint8));
                } else {
                        *data = NULL;
                }
@@ -1020,8 +1265,9 @@ uint32 _spoolss_getprinterdata(POLICY_HND *handle, UNISTR2 *valuename,
        
        if (*needed > *out_size)
                return ERROR_MORE_DATA;
-       else
+       else {
                return NT_STATUS_NO_PROBLEMO;
+    }
 }
 
 /***************************************************************************
@@ -1061,15 +1307,21 @@ static BOOL srv_spoolss_replyopenprinter(char *printer, uint32 localprinter, uin
  * in fact ReplyOpenPrinter is the changenotify equivalent on the spoolss pipe
  * called from api_spoolss_rffpcnex
  ********************************************************************/
-uint32 _spoolss_rffpcnex(POLICY_HND *handle, uint32 flags, uint32 options,
-                        const UNISTR2 *localmachine, uint32 printerlocal,
-                        SPOOL_NOTIFY_OPTION *option)
+
+uint32 _spoolss_rffpcnex(pipes_struct *p, SPOOL_Q_RFFPCNEX *q_u, SPOOL_R_RFFPCNEX *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+       uint32 flags = q_u->flags;
+       uint32 options = q_u->options;
+       UNISTR2 *localmachine = &q_u->localmachine;
+       uint32 printerlocal = q_u->printerlocal;
+       SPOOL_NOTIFY_OPTION *option = q_u->option;
+
        /* store the notify value in the printer struct */
 
-       Printer_entry *Printer=find_printer_index_by_hnd(handle);
+       Printer_entry *Printer=find_printer_index_by_hnd(p, handle);
 
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("_spoolss_rffpcnex: Invalid handle (%s).\n", OUR_HANDLE(handle)));
                return ERROR_INVALID_HANDLE;
        }
@@ -1077,7 +1329,12 @@ uint32 _spoolss_rffpcnex(POLICY_HND *handle, uint32 flags, uint32 options,
        Printer->notify.flags=flags;
        Printer->notify.options=options;
        Printer->notify.printerlocal=printerlocal;
-       Printer->notify.option=option;
+
+       if (Printer->notify.option)
+               free_spool_notify_option(&Printer->notify.option);
+
+       Printer->notify.option=dup_spool_notify_option(option);
+
        unistr2_to_ascii(Printer->notify.localmachine, localmachine, sizeof(Printer->notify.localmachine)-1);
 
        /* connect to the client machine and send a ReplyOpenPrinter */
@@ -1092,53 +1349,117 @@ uint32 _spoolss_rffpcnex(POLICY_HND *handle, uint32 flags, uint32 options,
 /*******************************************************************
  * fill a notify_info_data with the servername
  ********************************************************************/
-static void spoolss_notify_server_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue,
-                                                                               NT_PRINTER_INFO_LEVEL *printer)
+
+static void spoolss_notify_server_name(int snum, 
+                                      SPOOL_NOTIFY_INFO_DATA *data, 
+                                      print_queue_struct *queue,
+                                      NT_PRINTER_INFO_LEVEL *printer,
+                                      TALLOC_CTX *mem_ctx) 
 {
-       pstring temp_name;
+       pstring temp_name, temp;
+       uint32 len;
+
+       slprintf(temp_name, sizeof(temp_name)-1, "\\\\%s", global_myname);
 
-       snprintf(temp_name, sizeof(temp_name)-1, "\\\\%s", global_myname);
+       len = (uint32)dos_PutUniCode(temp, temp_name, sizeof(temp) - 2, True);
 
-       data->notify_data.data.length= (uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                                       temp_name, sizeof(data->notify_data.data.string), True) - sizeof(uint16))/sizeof(uint16));
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
  * fill a notify_info_data with the printername (not including the servername).
  ********************************************************************/
-static void spoolss_notify_printer_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue,
-                                                                               NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_printer_name(int snum, 
+                                       SPOOL_NOTIFY_INFO_DATA *data, 
+                                       print_queue_struct *queue,
+                                       NT_PRINTER_INFO_LEVEL *printer,
+                                       TALLOC_CTX *mem_ctx)
 {
+       pstring temp;
+       uint32 len;
+               
        /* the notify name should not contain the \\server\ part */
        char *p = strrchr(printer->info_2->printername, '\\');
+
        if (!p) {
                p = printer->info_2->printername;
        } else {
                p++;
        }
 
-       data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                               p, sizeof(data->notify_data.data.string), True) - sizeof(uint16))/sizeof(uint16));
+       len = (uint32)dos_PutUniCode(temp, p, sizeof(temp) - 2, True);
+
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+       
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
  * fill a notify_info_data with the servicename
  ********************************************************************/
-static void spoolss_notify_share_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_share_name(int snum, 
+                                     SPOOL_NOTIFY_INFO_DATA *data, 
+                                     print_queue_struct *queue,
+                                     NT_PRINTER_INFO_LEVEL *printer,
+                                     TALLOC_CTX *mem_ctx)
 {
-       data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                       lp_servicename(snum), sizeof(data->notify_data.data.string),True) - sizeof(uint16))/sizeof(uint16));
+       pstring temp;
+       uint32 len;
+
+       len = (uint32)dos_PutUniCode(temp, lp_servicename(snum), 
+                                    sizeof(temp) - 2, True);
+
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+       
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
  * fill a notify_info_data with the port name
  ********************************************************************/
-static void spoolss_notify_port_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_port_name(int snum, 
+                                    SPOOL_NOTIFY_INFO_DATA *data, 
+                                    print_queue_struct *queue,
+                                    NT_PRINTER_INFO_LEVEL *printer,
+                                    TALLOC_CTX *mem_ctx)
 {
+       pstring temp;
+       uint32 len;
+
        /* even if it's strange, that's consistant in all the code */
 
-       data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-               printer->info_2->portname, sizeof(data->notify_data.data.string), True)  - sizeof(uint16))/sizeof(uint16));
+       len = (uint32)dos_PutUniCode(temp, printer->info_2->portname, 
+                                    sizeof(temp) - 2, True);
+
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+       
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
@@ -1146,23 +1467,57 @@ static void spoolss_notify_port_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, pri
  * jfmxxxx: it's incorrect, should be lp_printerdrivername()
  * but it doesn't exist, have to see what to do
  ********************************************************************/
-static void spoolss_notify_driver_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_driver_name(int snum, 
+                                      SPOOL_NOTIFY_INFO_DATA *data,
+                                      print_queue_struct *queue,
+                                      NT_PRINTER_INFO_LEVEL *printer,
+                                      TALLOC_CTX *mem_ctx)
 {
-       data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                       printer->info_2->drivername, sizeof(data->notify_data.data.string)-1, True)  - sizeof(uint16))/sizeof(uint16));
+       pstring temp;
+       uint32 len;
+
+       len = (uint32)dos_PutUniCode(temp, printer->info_2->drivername, 
+                                    sizeof(temp) - 2, True);
+
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+       
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
  * fill a notify_info_data with the comment
  ********************************************************************/
-static void spoolss_notify_comment(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_comment(int snum, 
+                                  SPOOL_NOTIFY_INFO_DATA *data,
+                                  print_queue_struct *queue,
+                                  NT_PRINTER_INFO_LEVEL *printer,
+                                  TALLOC_CTX *mem_ctx)
 {
+       pstring temp;
+       uint32 len;
+
        if (*printer->info_2->comment == '\0')
-               data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                       lp_comment(snum), sizeof(data->notify_data.data.string)-1, True)  - sizeof(uint16))/sizeof(uint16));
+               len = (uint32)dos_PutUniCode(temp, lp_comment(snum), 
+                                            sizeof(temp) - 2, True);
        else
-               data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                       printer->info_2->comment, sizeof(data->notify_data.data.string)-1, True)  - sizeof(uint16))/sizeof(uint16));
+               len = (uint32)dos_PutUniCode(temp, printer->info_2->comment, 
+                                            sizeof(temp) - 2, True);
+
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+       
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
@@ -1170,17 +1525,38 @@ static void spoolss_notify_comment(int snum, SPOOL_NOTIFY_INFO_DATA *data, print
  * jfm:xxxx incorrect, have to create a new smb.conf option
  * location = "Room 1, floor 2, building 3"
  ********************************************************************/
-static void spoolss_notify_location(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_location(int snum, 
+                                   SPOOL_NOTIFY_INFO_DATA *data,
+                                   print_queue_struct *queue,
+                                   NT_PRINTER_INFO_LEVEL *printer,
+                                   TALLOC_CTX *mem_ctx)
 {
-       data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                       printer->info_2->location, sizeof(data->notify_data.data.string)-1, True)  - sizeof(uint16))/sizeof(uint16));
+       pstring temp;
+       uint32 len;
+
+       len = (uint32)dos_PutUniCode(temp, printer->info_2->location, 
+                                    sizeof(temp) - 2, True);
+
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+       
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
  * fill a notify_info_data with the device mode
  * jfm:xxxx don't to it for know but that's a real problem !!!
  ********************************************************************/
-static void spoolss_notify_devmode(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_devmode(int snum, 
+                                  SPOOL_NOTIFY_INFO_DATA *data,
+                                  print_queue_struct *queue,
+                                  NT_PRINTER_INFO_LEVEL *printer,
+                                  TALLOC_CTX *mem_ctx)
 {
 }
 
@@ -1189,40 +1565,108 @@ static void spoolss_notify_devmode(int snum, SPOOL_NOTIFY_INFO_DATA *data, print
  * jfm:xxxx just return no file could add an option to smb.conf
  * separator file = "separator.txt"
  ********************************************************************/
-static void spoolss_notify_sepfile(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_sepfile(int snum, 
+                                  SPOOL_NOTIFY_INFO_DATA *data, 
+                                  print_queue_struct *queue,
+                                  NT_PRINTER_INFO_LEVEL *printer,
+                                  TALLOC_CTX *mem_ctx)
 {
-       data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                       printer->info_2->sepfile, sizeof(data->notify_data.data.string)-1,True)  - sizeof(uint16))/sizeof(uint16));
+       pstring temp;
+       uint32 len;
+
+       len = (uint32)dos_PutUniCode(temp, printer->info_2->sepfile, 
+                                    sizeof(temp) - 2, True);
+
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+       
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
  * fill a notify_info_data with the print processor
  * jfm:xxxx return always winprint to indicate we don't do anything to it
  ********************************************************************/
-static void spoolss_notify_print_processor(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_print_processor(int snum, 
+                                          SPOOL_NOTIFY_INFO_DATA *data,
+                                          print_queue_struct *queue,
+                                          NT_PRINTER_INFO_LEVEL *printer,
+                                          TALLOC_CTX *mem_ctx)
 {
-       data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                       printer->info_2->printprocessor, sizeof(data->notify_data.data.string)-1, True)  - sizeof(uint16))/sizeof(uint16));
+       pstring temp;
+       uint32 len;
+
+       len = (uint32)dos_PutUniCode(temp, printer->info_2->printprocessor, 
+                                    sizeof(temp) - 2, True);
+
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+       
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
  * fill a notify_info_data with the print processor options
  * jfm:xxxx send an empty string
  ********************************************************************/
-static void spoolss_notify_parameters(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_parameters(int snum, 
+                                     SPOOL_NOTIFY_INFO_DATA *data,
+                                     print_queue_struct *queue,
+                                     NT_PRINTER_INFO_LEVEL *printer,
+                                     TALLOC_CTX *mem_ctx)
 {
-       data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                       printer->info_2->parameters, sizeof(data->notify_data.data.string)-1, True)  - sizeof(uint16))/sizeof(uint16));
+       pstring temp;
+       uint32 len;
+
+       len = (uint32)dos_PutUniCode(temp, printer->info_2->parameters, 
+                                    sizeof(temp) - 2, True);
+
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+       
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
  * fill a notify_info_data with the data type
  * jfm:xxxx always send RAW as data type
  ********************************************************************/
-static void spoolss_notify_datatype(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_datatype(int snum, 
+                                   SPOOL_NOTIFY_INFO_DATA *data,
+                                   print_queue_struct *queue,
+                                   NT_PRINTER_INFO_LEVEL *printer,
+                                   TALLOC_CTX *mem_ctx)
 {
-       data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                       printer->info_2->datatype, sizeof(data->notify_data.data.string)-1, True)  - sizeof(uint16))/sizeof(uint16));
+       pstring temp;
+       uint32 len;
+
+       len = (uint32)dos_PutUniCode(temp, printer->info_2->datatype, 
+                                    sizeof(pstring) - 2, True);
+
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+       
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
@@ -1230,17 +1674,25 @@ static void spoolss_notify_datatype(int snum, SPOOL_NOTIFY_INFO_DATA *data, prin
  * jfm:xxxx send an null pointer to say no security desc
  * have to implement security before !
  ********************************************************************/
-static void spoolss_notify_security_desc(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_security_desc(int snum, 
+                                        SPOOL_NOTIFY_INFO_DATA *data,
+                                        print_queue_struct *queue,
+                                        NT_PRINTER_INFO_LEVEL *printer,
+                                        TALLOC_CTX *mem_ctx)
 {
        data->notify_data.data.length=0;
-       data->notify_data.data.string[0]=0x00;
+       data->notify_data.data.string = NULL;
 }
 
 /*******************************************************************
  * fill a notify_info_data with the attributes
  * jfm:xxxx a samba printer is always shared
  ********************************************************************/
-static void spoolss_notify_attributes(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_attributes(int snum, 
+                                     SPOOL_NOTIFY_INFO_DATA *data,
+                                     print_queue_struct *queue,
+                                     NT_PRINTER_INFO_LEVEL *printer,
+                                     TALLOC_CTX *mem_ctx)
 {
        data->notify_data.value[0] = printer->info_2->attributes;
 }
@@ -1248,7 +1700,11 @@ static void spoolss_notify_attributes(int snum, SPOOL_NOTIFY_INFO_DATA *data, pr
 /*******************************************************************
  * fill a notify_info_data with the priority
  ********************************************************************/
-static void spoolss_notify_priority(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_priority(int snum, 
+                                   SPOOL_NOTIFY_INFO_DATA *data,
+                                   print_queue_struct *queue,
+                                   NT_PRINTER_INFO_LEVEL *printer,
+                                   TALLOC_CTX *mem_ctx)
 {
        data->notify_data.value[0] = printer->info_2->priority;
 }
@@ -1256,7 +1712,11 @@ static void spoolss_notify_priority(int snum, SPOOL_NOTIFY_INFO_DATA *data, prin
 /*******************************************************************
  * fill a notify_info_data with the default priority
  ********************************************************************/
-static void spoolss_notify_default_priority(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_default_priority(int snum, 
+                                           SPOOL_NOTIFY_INFO_DATA *data,
+                                           print_queue_struct *queue,
+                                           NT_PRINTER_INFO_LEVEL *printer,
+                                           TALLOC_CTX *mem_ctx)
 {
        data->notify_data.value[0] = printer->info_2->default_priority;
 }
@@ -1264,7 +1724,11 @@ static void spoolss_notify_default_priority(int snum, SPOOL_NOTIFY_INFO_DATA *da
 /*******************************************************************
  * fill a notify_info_data with the start time
  ********************************************************************/
-static void spoolss_notify_start_time(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_start_time(int snum, 
+                                     SPOOL_NOTIFY_INFO_DATA *data,
+                                     print_queue_struct *queue,
+                                     NT_PRINTER_INFO_LEVEL *printer,
+                                     TALLOC_CTX *mem_ctx)
 {
        data->notify_data.value[0] = printer->info_2->starttime;
 }
@@ -1272,7 +1736,11 @@ static void spoolss_notify_start_time(int snum, SPOOL_NOTIFY_INFO_DATA *data, pr
 /*******************************************************************
  * fill a notify_info_data with the until time
  ********************************************************************/
-static void spoolss_notify_until_time(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_until_time(int snum, 
+                                     SPOOL_NOTIFY_INFO_DATA *data,
+                                     print_queue_struct *queue,
+                                     NT_PRINTER_INFO_LEVEL *printer,
+                                     TALLOC_CTX *mem_ctx)
 {
        data->notify_data.value[0] = printer->info_2->untiltime;
 }
@@ -1280,14 +1748,17 @@ static void spoolss_notify_until_time(int snum, SPOOL_NOTIFY_INFO_DATA *data, pr
 /*******************************************************************
  * fill a notify_info_data with the status
  ********************************************************************/
-static void spoolss_notify_status(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_status(int snum, 
+                                 SPOOL_NOTIFY_INFO_DATA *data,
+                                 print_queue_struct *queue,
+                                 NT_PRINTER_INFO_LEVEL *printer,
+                                 TALLOC_CTX *mem_ctx)
 {
-       int count;
        print_queue_struct *q=NULL;
        print_status_struct status;
 
        memset(&status, 0, sizeof(status));
-       count = print_queue_status(snum, &q, &status);
+       print_queue_status(snum, &q, &status);
        data->notify_data.value[0]=(uint32) status.status;
        safe_free(q);
 }
@@ -1295,7 +1766,11 @@ static void spoolss_notify_status(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_
 /*******************************************************************
  * fill a notify_info_data with the number of jobs queued
  ********************************************************************/
-static void spoolss_notify_cjobs(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_cjobs(int snum, 
+                                SPOOL_NOTIFY_INFO_DATA *data,
+                                print_queue_struct *queue,
+                                NT_PRINTER_INFO_LEVEL *printer, 
+                                TALLOC_CTX *mem_ctx)
 {
        print_queue_struct *q=NULL;
        print_status_struct status;
@@ -1308,7 +1783,11 @@ static void spoolss_notify_cjobs(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_q
 /*******************************************************************
  * fill a notify_info_data with the average ppm
  ********************************************************************/
-static void spoolss_notify_average_ppm(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_average_ppm(int snum, 
+                                      SPOOL_NOTIFY_INFO_DATA *data,
+                                      print_queue_struct *queue,
+                                      NT_PRINTER_INFO_LEVEL *printer,
+                                      TALLOC_CTX *mem_ctx)
 {
        /* always respond 8 pages per minutes */
        /* a little hard ! */
@@ -1318,16 +1797,37 @@ static void spoolss_notify_average_ppm(int snum, SPOOL_NOTIFY_INFO_DATA *data, p
 /*******************************************************************
  * fill a notify_info_data with username
  ********************************************************************/
-static void spoolss_notify_username(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_username(int snum, 
+                                   SPOOL_NOTIFY_INFO_DATA *data,
+                                   print_queue_struct *queue,
+                                   NT_PRINTER_INFO_LEVEL *printer,
+                                   TALLOC_CTX *mem_ctx)
 {
-       data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                       queue->user, sizeof(data->notify_data.data.string)-1, True)  - sizeof(uint16))/sizeof(uint16));
+       pstring temp;
+       uint32 len;
+
+       len = (uint32)dos_PutUniCode(temp, queue->user, 
+                                    sizeof(temp) - 2, True);
+
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+       
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
  * fill a notify_info_data with job status
  ********************************************************************/
-static void spoolss_notify_job_status(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_job_status(int snum, 
+                                     SPOOL_NOTIFY_INFO_DATA *data,
+                                     print_queue_struct *queue,
+                                     NT_PRINTER_INFO_LEVEL *printer,
+                                     TALLOC_CTX *mem_ctx)
 {
        data->notify_data.value[0]=nt_printj_status(queue->status);
 }
@@ -1335,18 +1835,48 @@ static void spoolss_notify_job_status(int snum, SPOOL_NOTIFY_INFO_DATA *data, pr
 /*******************************************************************
  * fill a notify_info_data with job name
  ********************************************************************/
-static void spoolss_notify_job_name(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_job_name(int snum, 
+                                   SPOOL_NOTIFY_INFO_DATA *data,
+                                   print_queue_struct *queue,
+                                   NT_PRINTER_INFO_LEVEL *printer,
+                                   TALLOC_CTX *mem_ctx)
 {
-       data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                       queue->file, sizeof(data->notify_data.data.string)-1, True)  - sizeof(uint16))/sizeof(uint16));
+       pstring temp;
+       uint32 len;
+
+       len = (uint32)dos_PutUniCode(temp, queue->file, sizeof(temp) - 2, 
+                                    True);
+
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+       
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
  * fill a notify_info_data with job status
  ********************************************************************/
-static void spoolss_notify_job_status_string(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_job_status_string(int snum, 
+                                            SPOOL_NOTIFY_INFO_DATA *data,
+                                            print_queue_struct *queue,
+                                            NT_PRINTER_INFO_LEVEL *printer, 
+                                            TALLOC_CTX *mem_ctx)
 {
-       char *p = "unknown";
+       /*
+        * Now we're returning job status codes we just return a "" here. JRA.
+        */
+
+       char *p = "";
+       pstring temp;
+       uint32 len;
+
+#if 0 /* NO LONGER NEEDED - JRA. 02/22/2001 */
+       p = "unknown";
 
        switch (queue->status) {
        case LPQ_QUEUED:
@@ -1362,14 +1892,29 @@ static void spoolss_notify_job_status_string(int snum, SPOOL_NOTIFY_INFO_DATA *d
                p = "Printing";
                break;
        }
-       data->notify_data.data.length=(uint32)((dos_PutUniCode((char *)data->notify_data.data.string,
-                               p, sizeof(data->notify_data.data.string)-1, True)  - sizeof(uint16))/sizeof(uint16));
+#endif /* NO LONGER NEEDED. */
+
+       len = (uint32)dos_PutUniCode(temp, p, sizeof(temp) - 2, True);
+
+       data->notify_data.data.length = len / 2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+       
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       memcpy(data->notify_data.data.string, temp, len);
 }
 
 /*******************************************************************
  * fill a notify_info_data with job time
  ********************************************************************/
-static void spoolss_notify_job_time(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_job_time(int snum, 
+                                   SPOOL_NOTIFY_INFO_DATA *data,
+                                   print_queue_struct *queue,
+                                   NT_PRINTER_INFO_LEVEL *printer,
+                                   TALLOC_CTX *mem_ctx)
 {
        data->notify_data.value[0]=0x0;
 }
@@ -1377,7 +1922,11 @@ static void spoolss_notify_job_time(int snum, SPOOL_NOTIFY_INFO_DATA *data, prin
 /*******************************************************************
  * fill a notify_info_data with job size
  ********************************************************************/
-static void spoolss_notify_job_size(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_job_size(int snum, 
+                                   SPOOL_NOTIFY_INFO_DATA *data,
+                                   print_queue_struct *queue,
+                                   NT_PRINTER_INFO_LEVEL *printer,
+                                   TALLOC_CTX *mem_ctx)
 {
        data->notify_data.value[0]=queue->size;
 }
@@ -1385,7 +1934,11 @@ static void spoolss_notify_job_size(int snum, SPOOL_NOTIFY_INFO_DATA *data, prin
 /*******************************************************************
  * fill a notify_info_data with job position
  ********************************************************************/
-static void spoolss_notify_job_position(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_job_position(int snum, 
+                                       SPOOL_NOTIFY_INFO_DATA *data,
+                                       print_queue_struct *queue,
+                                       NT_PRINTER_INFO_LEVEL *printer,
+                                       TALLOC_CTX *mem_ctx)
 {
        data->notify_data.value[0]=queue->job;
 }
@@ -1393,14 +1946,30 @@ static void spoolss_notify_job_position(int snum, SPOOL_NOTIFY_INFO_DATA *data,
 /*******************************************************************
  * fill a notify_info_data with submitted time
  ********************************************************************/
-static void spoolss_notify_submitted_time(int snum, SPOOL_NOTIFY_INFO_DATA *data, print_queue_struct *queue, NT_PRINTER_INFO_LEVEL *printer)
+static void spoolss_notify_submitted_time(int snum, 
+                                         SPOOL_NOTIFY_INFO_DATA *data,
+                                         print_queue_struct *queue,
+                                         NT_PRINTER_INFO_LEVEL *printer,
+                                         TALLOC_CTX *mem_ctx)
 {
        struct tm *t;
+       uint32 len;
+       SYSTEMTIME st;
 
        t=gmtime(&queue->time);
 
-       data->notify_data.data.length = sizeof(SYSTEMTIME);
-       make_systemtime((SYSTEMTIME*)(data->notify_data.data.string), t);
+       len = sizeof(SYSTEMTIME);
+
+       data->notify_data.data.length = len/2 - 1;
+       data->notify_data.data.string = (uint16 *)talloc(mem_ctx, len);
+
+       if (!data->notify_data.data.string) {
+               data->notify_data.data.length = 0;
+               return;
+       }
+       
+       make_systemtime(&st, t);
+       memcpy(data->notify_data.data.string,&st,len);
 }
 
 #define END 65535
@@ -1413,7 +1982,7 @@ struct s_notify_info_data_table
        uint32 size;
        void (*fn) (int snum, SPOOL_NOTIFY_INFO_DATA *data,
                    print_queue_struct *queue,
-                   NT_PRINTER_INFO_LEVEL *printer);
+                   NT_PRINTER_INFO_LEVEL *printer, TALLOC_CTX *mem_ctx);
 };
 
 struct s_notify_info_data_table notify_info_data_table[] =
@@ -1555,7 +2124,10 @@ static void construct_info_data(SPOOL_NOTIFY_INFO_DATA *info_data, uint16 type,
  * fill a notify_info struct with info asked
  *
  ********************************************************************/
-static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int snum, SPOOL_NOTIFY_OPTION_TYPE *option_type, uint32 id)
+static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int
+                                         snum, SPOOL_NOTIFY_OPTION_TYPE
+                                         *option_type, uint32 id,
+                                         TALLOC_CTX *mem_ctx) 
 {
        int field_num,j;
        uint16 type;
@@ -1564,12 +2136,10 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int snum, SPO
        SPOOL_NOTIFY_INFO_DATA *current_data;
        NT_PRINTER_INFO_LEVEL *printer = NULL;
        print_queue_struct *queue=NULL;
-       
-       DEBUG(4,("construct_notify_printer_info\n"));
-       
+
        type=option_type->type;
 
-       DEBUGADD(4,("Notify type: [%s], number of notify info: [%d] on printer: [%s]\n",
+       DEBUG(4,("construct_notify_printer_info: Notify type: [%s], number of notify info: [%d] on printer: [%s]\n",
                (option_type->type==PRINTER_NOTIFY_TYPE?"PRINTER_NOTIFY_TYPE":"JOB_NOTIFY_TYPE"),
                option_type->count, lp_servicename(snum)));
        
@@ -1578,22 +2148,23 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int snum, SPO
 
        for(field_num=0; field_num<option_type->count; field_num++) {
                field = option_type->fields[field_num];
-               DEBUGADD(4,("notify [%d]: type [%x], field [%x]\n", field_num, type, field));
+               DEBUG(4,("construct_notify_printer_info: notify [%d]: type [%x], field [%x]\n", field_num, type, field));
 
                if (!search_notify(type, field, &j) )
                        continue;
                
-               if((info->data=Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
+               if((info->data=(SPOOL_NOTIFY_INFO_DATA *)Realloc(info->data, (info->count+1)*sizeof(SPOOL_NOTIFY_INFO_DATA))) == NULL) {
                        return False;
                }
                current_data=&info->data[info->count];
 
                construct_info_data(current_data, type, field, id);             
 
-               DEBUG(10,("construct_notify_printer_info: calling %s\n",
-                               notify_info_data_table[j].name ));
+               DEBUG(10,("construct_notify_printer_info: calling [%s]  snum=%d  printername=[%s])\n",
+                               notify_info_data_table[j].name, snum, printer->info_2->printername ));
 
-               notify_info_data_table[j].fn(snum, current_data, queue, printer);
+               notify_info_data_table[j].fn(snum, current_data, queue,
+                                            printer, mem_ctx);
 
                info->count++;
        }
@@ -1607,14 +2178,18 @@ static BOOL construct_notify_printer_info(SPOOL_NOTIFY_INFO *info, int snum, SPO
  * fill a notify_info struct with info asked
  *
  ********************************************************************/
-static BOOL construct_notify_jobs_info(print_queue_struct *queue, SPOOL_NOTIFY_INFO *info, int snum, SPOOL_NOTIFY_OPTION_TYPE *option_type, uint32 id)
+static BOOL construct_notify_jobs_info(print_queue_struct *queue,
+                                      SPOOL_NOTIFY_INFO *info,
+                                      NT_PRINTER_INFO_LEVEL *printer,
+                                      int snum, SPOOL_NOTIFY_OPTION_TYPE
+                                      *option_type, uint32 id,
+                                      TALLOC_CTX *mem_ctx) 
 {
        int field_num,j;
        uint16 type;
        uint16 field;
 
        SPOOL_NOTIFY_INFO_DATA *current_data;
-       NT_PRINTER_INFO_LEVEL *printer = NULL;
        
        DEBUG(4,("construct_notify_jobs_info\n"));
        
@@ -1624,9 +2199,6 @@ static BOOL construct_notify_jobs_info(print_queue_struct *queue, SPOOL_NOTIFY_I
                (option_type->type==PRINTER_NOTIFY_TYPE?"PRINTER_NOTIFY_TYPE":"JOB_NOTIFY_TYPE"),
                option_type->count));
 
-       if (get_a_printer(&printer, 2, lp_servicename(snum))!=0)
-               return False;
-       
        for(field_num=0; field_num<option_type->count; field_num++) {
                field = option_type->fields[field_num];
 
@@ -1640,11 +2212,11 @@ static BOOL construct_notify_jobs_info(print_queue_struct *queue, SPOOL_NOTIFY_I
                current_data=&(info->data[info->count]);
 
                construct_info_data(current_data, type, field, id);
-               notify_info_data_table[j].fn(snum, current_data, queue, printer);
+               notify_info_data_table[j].fn(snum, current_data, queue,
+                                            printer, mem_ctx);
                info->count++;
        }
 
-       free_a_printer(&printer, 2);    
        return True;
 }
 
@@ -1671,18 +2243,19 @@ static BOOL construct_notify_jobs_info(print_queue_struct *queue, SPOOL_NOTIFY_I
  * that's the print server case, the printer case is even worse.
  */
 
-
-
 /*******************************************************************
  *
  * enumerate all printers on the printserver
  * fill a notify_info struct with info asked
  *
  ********************************************************************/
-static uint32 printserver_notify_info(const POLICY_HND *hnd, SPOOL_NOTIFY_INFO *info)
+
+static uint32 printserver_notify_info(pipes_struct *p, POLICY_HND *hnd, 
+                                     SPOOL_NOTIFY_INFO *info,
+                                     TALLOC_CTX *mem_ctx)
 {
        int snum;
-       Printer_entry *Printer=find_printer_index_by_hnd(hnd);
+       Printer_entry *Printer=find_printer_index_by_hnd(p, hnd);
        int n_services=lp_numservices();
        int i;
        uint32 id;
@@ -1705,7 +2278,8 @@ static uint32 printserver_notify_info(const POLICY_HND *hnd, SPOOL_NOTIFY_INFO *
                
                for (snum=0; snum<n_services; snum++)
                        if ( lp_browseable(snum) && lp_snum_ok(snum) && lp_print_ok(snum) )
-                               if (construct_notify_printer_info(info, snum, option_type, id))
+                               if (construct_notify_printer_info
+                                   (info, snum, option_type, id, mem_ctx))
                                        id++;
        }
                        
@@ -1732,10 +2306,11 @@ static uint32 printserver_notify_info(const POLICY_HND *hnd, SPOOL_NOTIFY_INFO *
  * fill a notify_info struct with info asked
  *
  ********************************************************************/
-static uint32 printer_notify_info(POLICY_HND *hnd, SPOOL_NOTIFY_INFO *info)
+static uint32 printer_notify_info(pipes_struct *p, POLICY_HND *hnd, SPOOL_NOTIFY_INFO *info,
+                                 TALLOC_CTX *mem_ctx)
 {
        int snum;
-       Printer_entry *Printer=find_printer_index_by_hnd(hnd);
+       Printer_entry *Printer=find_printer_index_by_hnd(p, hnd);
        int i;
        uint32 id;
        SPOOL_NOTIFY_OPTION *option;
@@ -1752,25 +2327,44 @@ static uint32 printer_notify_info(POLICY_HND *hnd, SPOOL_NOTIFY_INFO *info)
        info->data=NULL;
        info->count=0;
 
-       get_printer_snum(hnd, &snum);
+       get_printer_snum(p, hnd, &snum);
 
        for (i=0; i<option->count; i++) {
                option_type=&option->ctr.type[i];
                
                switch ( option_type->type ) {
                case PRINTER_NOTIFY_TYPE:
-                       if(construct_notify_printer_info(info, snum, option_type, id))
+                       if(construct_notify_printer_info(info, snum, 
+                                                        option_type, id,
+                                                        mem_ctx))  
                                id--;
                        break;
                        
-               case JOB_NOTIFY_TYPE:
+               case JOB_NOTIFY_TYPE: {
+                       NT_PRINTER_INFO_LEVEL *printer = NULL;
+
                        memset(&status, 0, sizeof(status));     
                        count = print_queue_status(snum, &queue, &status);
-                       for (j=0; j<count; j++)
-                               construct_notify_jobs_info(&queue[j], info, snum, option_type, queue[j].job);
+
+                       if (get_a_printer(&printer, 2, 
+                                         lp_servicename(snum)) != 0)
+                               goto done;
+
+                       for (j=0; j<count; j++) {
+                               construct_notify_jobs_info(&queue[j], info,
+                                                          printer, snum,
+                                                          option_type,
+                                                          queue[j].job,
+                                                          mem_ctx); 
+                       }
+
+                       free_a_printer(&printer, 2);
+                       
+               done:
                        safe_free(queue);
                        break;
                }
+               }
        }
        
        /*
@@ -1793,14 +2387,24 @@ static uint32 printer_notify_info(POLICY_HND *hnd, SPOOL_NOTIFY_INFO *info)
 /********************************************************************
  * spoolss_rfnpcnex
  ********************************************************************/
-uint32 _spoolss_rfnpcnex( POLICY_HND *handle, uint32 change,
-                         SPOOL_NOTIFY_OPTION *option, SPOOL_NOTIFY_INFO *info)
+
+uint32 _spoolss_rfnpcnex( pipes_struct *p, SPOOL_Q_RFNPCNEX *q_u, SPOOL_R_RFNPCNEX *r_u)
 {
-       Printer_entry *Printer=find_printer_index_by_hnd(handle);
+       POLICY_HND *handle = &q_u->handle;
+/*     uint32 change = q_u->change; - notused. */
+/*     SPOOL_NOTIFY_OPTION *option = q_u->option; - notused. */
+       SPOOL_NOTIFY_INFO *info = &r_u->info;
 
-       if (!OPEN_HANDLE(Printer)) {
-               DEBUG(0,("_spoolss_rfnpcnex: Invalid handle (%s).\n",OUR_HANDLE(handle)));
-               return ERROR_INVALID_HANDLE;
+       Printer_entry *Printer=find_printer_index_by_hnd(p, handle);
+       uint32 result = ERROR_INVALID_HANDLE;
+
+       /* we always have a NOTIFY_INFO struct */
+       r_u->info_ptr=0x1;
+
+       if (!Printer) {
+               DEBUG(0,("_spoolss_rfnpcnex: Invalid handle (%s).\n",
+                        OUR_HANDLE(handle)));
+               goto done;
        }
 
        DEBUG(4,("Printer type %x\n",Printer->printer_type));
@@ -1816,18 +2420,20 @@ uint32 _spoolss_rfnpcnex( POLICY_HND *handle, uint32 change,
         *      informations even when _NOTHING_ has changed.
         */
 
-       /* just discard the SPOOL_NOTIFY_OPTION */
-       if (option!=NULL)
-               safe_free(option->ctr.type);
+       /* just ignore the SPOOL_NOTIFY_OPTION */
        
        switch (Printer->printer_type) {
                case PRINTER_HANDLE_IS_PRINTSERVER:
-                       return printserver_notify_info(handle, info);
+                       result = printserver_notify_info(p, handle, info, p->mem_ctx);
+                       break;
+                       
                case PRINTER_HANDLE_IS_PRINTER:
-                       return printer_notify_info(handle, info);
+                       result = printer_notify_info(p, handle, info, p->mem_ctx);
+                       break;
        }
-
-       return ERROR_INVALID_HANDLE;
+       
+ done:
+       return result;
 }
 
 /********************************************************************
@@ -1919,11 +2525,11 @@ static BOOL construct_printer_info_0(PRINTER_INFO_0 *printer, int snum)
        printer->unknown13 = 0x0;
        printer->unknown14 = 0x1;
        printer->unknown15 = 0x024a;            /* 586 Pentium ? */
-       printer->unknown16 = 0x0;
+       printer->unknown16 =  0x0;
        printer->change_id = ntprinter->info_2->changeid; /* ChangeID in milliseconds*/
-       printer->unknown18 = 0x0;
+       printer->unknown18 =  0x0;
        printer->status = nt_printq_status(status.status);
-       printer->unknown20 = 0x0;
+       printer->unknown20 =  0x0;
        printer->c_setprinter = ntprinter->info_2->c_setprinter; /* how many times setprinter has been called */
        printer->unknown22 = 0x0;
        printer->unknown23 = 0x6;               /* 6  ???*/
@@ -1956,16 +2562,16 @@ static BOOL construct_printer_info_1(uint32 flags, PRINTER_INFO_1 *printer, int
 
        if (*ntprinter->info_2->comment == '\0') {
                init_unistr(&printer->comment, lp_comment(snum));
-               snprintf(chaine,sizeof(chaine)-1,"%s%s,%s,%s",global_myname, ntprinter->info_2->printername,
+               slprintf(chaine,sizeof(chaine)-1,"%s%s,%s,%s",global_myname, ntprinter->info_2->printername,
                        ntprinter->info_2->drivername, lp_comment(snum));
        }
        else {
                init_unistr(&printer->comment, ntprinter->info_2->comment); /* saved comment. */
-               snprintf(chaine,sizeof(chaine)-1,"%s%s,%s,%s",global_myname, ntprinter->info_2->printername,
+               slprintf(chaine,sizeof(chaine)-1,"%s%s,%s,%s",global_myname, ntprinter->info_2->printername,
                        ntprinter->info_2->drivername, ntprinter->info_2->comment);
        }
                
-       snprintf(chaine2,sizeof(chaine)-1,"%s", ntprinter->info_2->printername);
+       slprintf(chaine2,sizeof(chaine)-1,"%s", ntprinter->info_2->printername);
 
        init_unistr(&printer->description, chaine);
        init_unistr(&printer->name, chaine2);   
@@ -2024,10 +2630,10 @@ static DEVICEMODE *construct_dev_mode(int snum)
 
        DEBUGADD(8,("loading DEVICEMODE\n"));
 
-       snprintf(adevice, sizeof(adevice), printer->info_2->printername);
+       slprintf(adevice, sizeof(adevice)-1, printer->info_2->printername);
        init_unistr(&devmode->devicename, adevice);
 
-       snprintf(aform, sizeof(aform), ntdevmode->formname);
+       slprintf(aform, sizeof(aform)-1, ntdevmode->formname);
        init_unistr(&devmode->formname, aform);
 
        devmode->specversion      = ntdevmode->specversion;
@@ -2219,7 +2825,7 @@ static BOOL enum_all_printers_info_1(uint32 flags, NEW_BUFFER *buffer, uint32 of
                                        return ERROR_NOT_ENOUGH_MEMORY;
                                }
                                DEBUG(4,("ReAlloced memory for [%d] PRINTER_INFO_1\n", *returned));             
-                               memcpy(&(printers[*returned]), &current_prt, sizeof(PRINTER_INFO_1));
+                               memcpy(&printers[*returned], &current_prt, sizeof(PRINTER_INFO_1));
                                (*returned)++;
                        }
                }
@@ -2227,14 +2833,14 @@ static BOOL enum_all_printers_info_1(uint32 flags, NEW_BUFFER *buffer, uint32 of
                
        /* check the required size. */  
        for (i=0; i<*returned; i++)
-               (*needed) += spoolss_size_printer_info_1(&(printers[i]));
+               (*needed) += spoolss_size_printer_info_1(&printers[i]);
 
        if (!alloc_buffer_size(buffer, *needed))
                return ERROR_INSUFFICIENT_BUFFER;
 
        /* fill the buffer with the structures */
        for (i=0; i<*returned; i++)
-               new_smb_io_printer_info_1("", buffer, &(printers[i]), 0);       
+               new_smb_io_printer_info_1("", buffer, &printers[i], 0); 
 
        /* clear memory */
        safe_free(printers);
@@ -2298,9 +2904,9 @@ static BOOL enum_all_printers_info_1_remote(fstring name, NEW_BUFFER *buffer, ui
 
        *returned=1;
        
-       snprintf(printername, sizeof(printername)-1,"Windows NT Remote Printers!!\\\\%s", global_myname);               
-       snprintf(desc, sizeof(desc)-1,"%s", global_myname);
-       snprintf(comment, sizeof(comment)-1, "Logged on Domain");
+       slprintf(printername, sizeof(printername)-1,"Windows NT Remote Printers!!\\\\%s", global_myname);               
+       slprintf(desc, sizeof(desc)-1,"%s", global_myname);
+       slprintf(comment, sizeof(comment)-1, "Logged on Domain");
 
        init_unistr(&printer->description, desc);
        init_unistr(&printer->name, printername);       
@@ -2332,6 +2938,7 @@ static BOOL enum_all_printers_info_1_remote(fstring name, NEW_BUFFER *buffer, ui
 /********************************************************************
  enum_all_printers_info_1_network.
 *********************************************************************/
+
 static BOOL enum_all_printers_info_1_network(NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        DEBUG(4,("enum_all_printers_info_1_network\n"));        
@@ -2344,6 +2951,7 @@ static BOOL enum_all_printers_info_1_network(NEW_BUFFER *buffer, uint32 offered,
  *
  * called from api_spoolss_enumprinters (see this to understand)
  ********************************************************************/
+
 static BOOL enum_all_printers_info_2(NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        int snum;
@@ -2373,7 +2981,6 @@ static BOOL enum_all_printers_info_2(NEW_BUFFER *buffer, uint32 offered, uint32
        if (!alloc_buffer_size(buffer, *needed)) {
                for (i=0; i<*returned; i++) {
                        free_devmode(printers[i].devmode);
-                       free_sec_desc(&printers[i].secdesc);
                }
                safe_free(printers);
                return ERROR_INSUFFICIENT_BUFFER;
@@ -2386,7 +2993,6 @@ static BOOL enum_all_printers_info_2(NEW_BUFFER *buffer, uint32 offered, uint32
        /* clear memory */
        for (i=0; i<*returned; i++) {
                free_devmode(printers[i].devmode);
-               free_sec_desc(&printers[i].secdesc);
        }
        safe_free(printers);
 
@@ -2470,12 +3076,23 @@ static uint32 enumprinters_level5( uint32 flags, fstring servername,
  *
  * called from api_spoolss_enumprinters (see this to understand)
  ********************************************************************/
-uint32 _spoolss_enumprinters( uint32 flags, const UNISTR2 *servername, uint32 level,
-                             NEW_BUFFER *buffer, uint32 offered,
-                             uint32 *needed, uint32 *returned)
+
+uint32 _spoolss_enumprinters( pipes_struct *p, SPOOL_Q_ENUMPRINTERS *q_u, SPOOL_R_ENUMPRINTERS *r_u)
 {
+       uint32 flags = q_u->flags;
+       UNISTR2 *servername = &q_u->servername;
+       uint32 level = q_u->level;
+       NEW_BUFFER *buffer = NULL;
+       uint32 offered = q_u->offered;
+       uint32 *needed = &r_u->needed;
+       uint32 *returned = &r_u->returned;
+
        fstring name;
        
+       /* that's an [in out] buffer */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+       buffer = r_u->buffer;
+
        DEBUG(4,("_spoolss_enumprinters\n"));
 
        *needed=0;
@@ -2642,14 +3259,24 @@ static uint32 getprinter_level_3(int snum, NEW_BUFFER *buffer, uint32 offered, u
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_getprinter(POLICY_HND *handle, uint32 level,
-                          NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
+
+uint32 _spoolss_getprinter(pipes_struct *p, SPOOL_Q_GETPRINTER *q_u, SPOOL_R_GETPRINTER *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+       uint32 level = q_u->level;
+       NEW_BUFFER *buffer = NULL;
+       uint32 offered = q_u->offered;
+       uint32 *needed = &r_u->needed;
+
        int snum;
-       
+
+       /* that's an [in out] buffer */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+       buffer = r_u->buffer;
+
        *needed=0;
 
-       if (!get_printer_snum(handle, &snum))
+       if (!get_printer_snum(p, handle, &snum))
                return ERROR_INVALID_HANDLE;
 
        switch (level) {
@@ -2703,23 +3330,31 @@ static uint32 construct_printer_driver_info_1(DRIVER_INFO_1 *info, int snum, fst
  ********************************************************************/
 static void fill_printer_driver_info_2(DRIVER_INFO_2 *info, NT_PRINTER_DRIVER_INFO_LEVEL driver, fstring servername)
 {
-       pstring temp_driverpath;
-       pstring temp_datafile;
-       pstring temp_configfile;
+       pstring temp;
 
        info->version=driver.info_3->cversion;
 
        init_unistr( &info->name, driver.info_3->name );
        init_unistr( &info->architecture, driver.info_3->environment );
 
-       snprintf(temp_driverpath, sizeof(temp_driverpath)-1, "\\\\%s%s", servername, driver.info_3->driverpath);
-       init_unistr( &info->driverpath, temp_driverpath );
 
-       snprintf(temp_datafile, sizeof(temp_datafile)-1, "\\\\%s%s", servername, driver.info_3->datafile);
-       init_unistr( &info->datafile, temp_datafile );
+    if (strlen(driver.info_3->driverpath)) {
+               slprintf(temp, sizeof(temp)-1, "\\\\%s%s", servername, driver.info_3->driverpath);
+               init_unistr( &info->driverpath, temp );
+    } else
+        init_unistr( &info->driverpath, "" );
 
-       snprintf(temp_configfile, sizeof(temp_configfile)-1, "\\\\%s%s", servername, driver.info_3->configfile);
-       init_unistr( &info->configfile, temp_configfile );      
+       if (strlen(driver.info_3->datafile)) {
+               slprintf(temp, sizeof(temp)-1, "\\\\%s%s", servername, driver.info_3->datafile);
+               init_unistr( &info->datafile, temp );
+       } else
+               init_unistr( &info->datafile, "" );
+       
+       if (strlen(driver.info_3->configfile)) {
+               slprintf(temp, sizeof(temp)-1, "\\\\%s%s", servername, driver.info_3->configfile);
+               init_unistr( &info->configfile, temp ); 
+       } else
+               init_unistr( &info->configfile, "" );
 }
 
 /********************************************************************
@@ -2770,7 +3405,7 @@ static void init_unistr_array(uint16 **uni_array, fstring *char_array, char *ser
                        if (!v) v = ""; /* hack to handle null lists */
                }
                if (strlen(v) == 0) break;
-               snprintf(line, sizeof(line)-1, "\\\\%s%s", servername, v);
+               slprintf(line, sizeof(line)-1, "\\\\%s%s", servername, v);
                DEBUGADD(6,("%d:%s:%d\n", i, line, strlen(line)));
                if((*uni_array=Realloc(*uni_array, (j+strlen(line)+2)*sizeof(uint16))) == NULL) {
                        DEBUG(0,("init_unistr_array: Realloc error\n" ));
@@ -2793,10 +3428,7 @@ static void init_unistr_array(uint16 **uni_array, fstring *char_array, char *ser
  ********************************************************************/
 static void fill_printer_driver_info_3(DRIVER_INFO_3 *info, NT_PRINTER_DRIVER_INFO_LEVEL driver, fstring servername)
 {
-       pstring temp_driverpath;
-       pstring temp_datafile;
-       pstring temp_configfile;
-       pstring temp_helpfile;
+       pstring temp;
 
        ZERO_STRUCTP(info);
 
@@ -2805,17 +3437,29 @@ static void fill_printer_driver_info_3(DRIVER_INFO_3 *info, NT_PRINTER_DRIVER_IN
        init_unistr( &info->name, driver.info_3->name );        
        init_unistr( &info->architecture, driver.info_3->environment );
 
-       snprintf(temp_driverpath, sizeof(temp_driverpath)-1, "\\\\%s%s", servername, driver.info_3->driverpath);                
-       init_unistr( &info->driverpath, temp_driverpath );
-
-       snprintf(temp_datafile, sizeof(temp_datafile)-1, "\\\\%s%s", servername, driver.info_3->datafile);
-       init_unistr( &info->datafile, temp_datafile );
-
-       snprintf(temp_configfile, sizeof(temp_configfile)-1, "\\\\%s%s", servername, driver.info_3->configfile);
-       init_unistr( &info->configfile, temp_configfile );      
-
-       snprintf(temp_helpfile, sizeof(temp_helpfile)-1, "\\\\%s%s", servername, driver.info_3->helpfile);
-       init_unistr( &info->helpfile, temp_helpfile );
+    if (strlen(driver.info_3->driverpath)) {
+        slprintf(temp, sizeof(temp)-1, "\\\\%s%s", servername, driver.info_3->driverpath);             
+        init_unistr( &info->driverpath, temp );
+    } else
+        init_unistr( &info->driverpath, "" );
+    
+    if (strlen(driver.info_3->datafile)) {
+        slprintf(temp, sizeof(temp)-1, "\\\\%s%s", servername, driver.info_3->datafile);
+        init_unistr( &info->datafile, temp );
+    } else
+        init_unistr( &info->datafile, "" );
+
+    if (strlen(driver.info_3->configfile)) {
+        slprintf(temp, sizeof(temp)-1, "\\\\%s%s", servername, driver.info_3->configfile);
+        init_unistr( &info->configfile, temp );        
+    } else
+        init_unistr( &info->configfile, "" );
+
+    if (strlen(driver.info_3->helpfile)) {
+        slprintf(temp, sizeof(temp)-1, "\\\\%s%s", servername, driver.info_3->helpfile);
+        init_unistr( &info->helpfile, temp );
+    } else
+        init_unistr( &info->helpfile, "" );
 
        init_unistr( &info->monitorname, driver.info_3->monitorname );
        init_unistr( &info->defaultdatatype, driver.info_3->defaultdatatype );
@@ -2861,10 +3505,7 @@ static uint32 construct_printer_driver_info_3(DRIVER_INFO_3 *info, int snum, fst
 
 static void fill_printer_driver_info_6(DRIVER_INFO_6 *info, NT_PRINTER_DRIVER_INFO_LEVEL driver, fstring servername)
 {
-       pstring temp_driverpath;
-       pstring temp_datafile;
-       pstring temp_configfile;
-       pstring temp_helpfile;
+       pstring temp;
        fstring nullstr;
 
        ZERO_STRUCTP(info);
@@ -2875,18 +3516,30 @@ static void fill_printer_driver_info_6(DRIVER_INFO_6 *info, NT_PRINTER_DRIVER_IN
        init_unistr( &info->name, driver.info_3->name );        
        init_unistr( &info->architecture, driver.info_3->environment );
 
-       snprintf(temp_driverpath, sizeof(temp_driverpath)-1, "\\\\%s%s", servername, driver.info_3->driverpath);                
-       init_unistr( &info->driverpath, temp_driverpath );
-
-       snprintf(temp_datafile, sizeof(temp_datafile)-1, "\\\\%s%s", servername, driver.info_3->datafile);
-       init_unistr( &info->datafile, temp_datafile );
-
-       snprintf(temp_configfile, sizeof(temp_configfile)-1, "\\\\%s%s", servername, driver.info_3->configfile);
-       init_unistr( &info->configfile, temp_configfile );      
-
-       snprintf(temp_helpfile, sizeof(temp_helpfile)-1, "\\\\%s%s", servername, driver.info_3->helpfile);
-       init_unistr( &info->helpfile, temp_helpfile );
-
+       if (strlen(driver.info_3->driverpath)) {
+               slprintf(temp, sizeof(temp)-1, "\\\\%s%s", servername, driver.info_3->driverpath);              
+               init_unistr( &info->driverpath, temp );
+       } else
+               init_unistr( &info->driverpath, "" );
+
+       if (strlen(driver.info_3->datafile)) {
+               slprintf(temp, sizeof(temp)-1, "\\\\%s%s", servername, driver.info_3->datafile);
+               init_unistr( &info->datafile, temp );
+       } else
+               init_unistr( &info->datafile, "" );
+
+       if (strlen(driver.info_3->configfile)) {
+               slprintf(temp, sizeof(temp)-1, "\\\\%s%s", servername, driver.info_3->configfile);
+               init_unistr( &info->configfile, temp ); 
+       } else
+               init_unistr( &info->configfile, "" );
+
+       if (strlen(driver.info_3->helpfile)) {
+               slprintf(temp, sizeof(temp)-1, "\\\\%s%s", servername, driver.info_3->helpfile);
+               init_unistr( &info->helpfile, temp );
+       } else
+               init_unistr( &info->helpfile, "" );
+       
        init_unistr( &info->monitorname, driver.info_3->monitorname );
        init_unistr( &info->defaultdatatype, driver.info_3->defaultdatatype );
 
@@ -3111,15 +3764,28 @@ static uint32 getprinterdriver2_level6(fstring servername, fstring architecture,
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_getprinterdriver2(POLICY_HND *handle, const UNISTR2 *uni_arch, uint32 level,
-                               uint32 clientmajorversion, uint32 clientminorversion,
-                               NEW_BUFFER *buffer, uint32 offered,
-                               uint32 *needed, uint32 *servermajorversion, uint32 *serverminorversion)
+
+uint32 _spoolss_getprinterdriver2(pipes_struct *p, SPOOL_Q_GETPRINTERDRIVER2 *q_u, SPOOL_R_GETPRINTERDRIVER2 *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+       UNISTR2 *uni_arch = &q_u->architecture;
+       uint32 level = q_u->level;
+       uint32 clientmajorversion = q_u->clientmajorversion;
+/*     uint32 clientminorversion = q_u->clientminorversion; - notused. */
+       NEW_BUFFER *buffer = NULL;
+       uint32 offered = q_u->offered;
+       uint32 *needed = &r_u->needed;
+       uint32 *servermajorversion = &r_u->servermajorversion;
+       uint32 *serverminorversion = &r_u->serverminorversion;
+
        fstring servername;
        fstring architecture;
        int snum;
 
+       /* that's an [in out] buffer */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+       buffer = r_u->buffer;
+
        DEBUG(4,("_spoolss_getprinterdriver2\n"));
 
        *needed=0;
@@ -3129,7 +3795,7 @@ uint32 _spoolss_getprinterdriver2(POLICY_HND *handle, const UNISTR2 *uni_arch, u
        pstrcpy(servername, global_myname);
        unistr2_to_ascii(architecture, uni_arch, sizeof(architecture)-1);
 
-       if (!get_printer_snum(handle, &snum))
+       if (!get_printer_snum(p, handle, &snum))
                return ERROR_INVALID_HANDLE;
 
        switch (level) {
@@ -3148,11 +3814,14 @@ uint32 _spoolss_getprinterdriver2(POLICY_HND *handle, const UNISTR2 *uni_arch, u
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_startpageprinter(POLICY_HND *handle)
+
+uint32 _spoolss_startpageprinter(pipes_struct *p, SPOOL_Q_STARTPAGEPRINTER *q_u, SPOOL_R_STARTPAGEPRINTER *r_u)
 {
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       POLICY_HND *handle = &q_u->handle;
 
-       if (OPEN_HANDLE(Printer)) {
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
+
+       if (Printer) {
                Printer->page_started=True;
                return 0x0;
        }
@@ -3163,11 +3832,14 @@ uint32 _spoolss_startpageprinter(POLICY_HND *handle)
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_endpageprinter(POLICY_HND *handle)
+
+uint32 _spoolss_endpageprinter(pipes_struct *p, SPOOL_Q_ENDPAGEPRINTER *q_u, SPOOL_R_ENDPAGEPRINTER *r_u)
 {
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       POLICY_HND *handle = &q_u->handle;
 
-       if (!OPEN_HANDLE(Printer)) {
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
+
+       if (!Printer) {
                DEBUG(0,("_spoolss_endpageprinter: Invalid handle (%s).\n",OUR_HANDLE(handle)));
                return ERROR_INVALID_HANDLE;
        }
@@ -3177,39 +3849,27 @@ uint32 _spoolss_endpageprinter(POLICY_HND *handle)
        return NT_STATUS_NO_PROBLEMO;
 }
 
-/****************************************************************************
- Return a user struct for a pipe user.
-****************************************************************************/
-
-static struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
-{
-       if (p->ntlmssp_auth_validated) {
-               memcpy(user, &p->pipe_user, sizeof(struct current_user));
-       } else {
-               extern struct current_user current_user;
-               memcpy(user, &current_user, sizeof(struct current_user));
-       }
-
-       return user;
-}
-
 /********************************************************************
  * api_spoolss_getprinter
  * called from the spoolss dispatcher
  *
  ********************************************************************/
-uint32 _spoolss_startdocprinter(POLICY_HND *handle, uint32 level,
-                               pipes_struct *p, DOC_INFO *docinfo,
-                               uint32 *jobid)
+
+uint32 _spoolss_startdocprinter(pipes_struct *p, SPOOL_Q_STARTDOCPRINTER *q_u, SPOOL_R_STARTDOCPRINTER *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+/*     uint32 level = q_u->doc_info_container.level; - notused. */
+       DOC_INFO *docinfo = &q_u->doc_info_container.docinfo;
+       uint32 *jobid = &r_u->jobid;
+
        DOC_INFO_1 *info_1 = &docinfo->doc_info_1;
        int snum;
        pstring jobname;
        fstring datatype;
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
        struct current_user user;
 
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("_spoolss_startdocprinter: Invalid handle (%s)\n", OUR_HANDLE(handle)));
                return ERROR_INVALID_HANDLE;
        }
@@ -3237,7 +3897,7 @@ uint32 _spoolss_startdocprinter(POLICY_HND *handle, uint32 level,
        }               
        
        /* get the share number of the printer */
-       if (!get_printer_snum(handle, &snum)) {
+       if (!get_printer_snum(p, handle, &snum)) {
                return ERROR_INVALID_HANDLE;
        }
 
@@ -3255,7 +3915,6 @@ uint32 _spoolss_startdocprinter(POLICY_HND *handle, uint32 level,
        Printer->document_started=True;
        (*jobid) = Printer->jobid;
 
-       srv_spoolss_sendnotify(handle);
        return 0x0;
 }
 
@@ -3264,40 +3923,36 @@ uint32 _spoolss_startdocprinter(POLICY_HND *handle, uint32 level,
  * called from the spoolss dispatcher
  *
  ********************************************************************/
-uint32 _spoolss_enddocprinter(POLICY_HND *handle)
-{
-       Printer_entry *Printer=find_printer_index_by_hnd(handle);
-       
-       if (!OPEN_HANDLE(Printer)) {
-               DEBUG(0,("_spoolss_enddocprinter: Invalid handle (%s)\n", OUR_HANDLE(handle)));
-               return ERROR_INVALID_HANDLE;
-       }
-       
-       Printer->document_started=False;
-       print_job_end(Printer->jobid);
-       /* error codes unhandled so far ... */
 
-       srv_spoolss_sendnotify(handle);
+uint32 _spoolss_enddocprinter(pipes_struct *p, SPOOL_Q_ENDDOCPRINTER *q_u, SPOOL_R_ENDDOCPRINTER *r_u)
+{
+       POLICY_HND *handle = &q_u->handle;
 
-       return 0x0;
+       return _spoolss_enddocprinter_internal(p, handle);
 }
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_writeprinter( POLICY_HND *handle,
-                               uint32 buffer_size,
-                               uint8 *buffer,
-                               uint32 *buffer_written)
+
+uint32 _spoolss_writeprinter(pipes_struct *p, SPOOL_Q_WRITEPRINTER *q_u, SPOOL_R_WRITEPRINTER *r_u)
 {
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       POLICY_HND *handle = &q_u->handle;
+       uint32 buffer_size = q_u->buffer_size;
+       uint8 *buffer = q_u->buffer;
+       uint32 *buffer_written = &q_u->buffer_size2;
+
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
        
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("_spoolss_writeprinter: Invalid handle (%s)\n",OUR_HANDLE(handle)));
+               r_u->buffer_written = q_u->buffer_size2;
                return ERROR_INVALID_HANDLE;
        }
 
-       (*buffer_written) = print_job_write(Printer->jobid, (char *)buffer,
-                                           buffer_size);
+       (*buffer_written) = print_job_write(Printer->jobid, (char *)buffer, buffer_size);
+
+
+       r_u->buffer_written = q_u->buffer_size2;
 
        return 0x0;
 }
@@ -3312,16 +3967,16 @@ static uint32 control_printer(POLICY_HND *handle, uint32 command,
 {
        struct current_user user;
        int snum, errcode = ERROR_INVALID_FUNCTION;
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
 
        get_current_user(&user, p);
 
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("control_printer: Invalid handle (%s)\n", OUR_HANDLE(handle)));
                return ERROR_INVALID_HANDLE;
        }
 
-       if (!get_printer_snum(handle, &snum))
+       if (!get_printer_snum(p, handle, &snum))
                return ERROR_INVALID_HANDLE;
 
        switch (command) {
@@ -3352,8 +4007,10 @@ static uint32 control_printer(POLICY_HND *handle, uint32 command,
  * api_spoolss_abortprinter
  ********************************************************************/
 
-uint32 _spoolss_abortprinter(POLICY_HND *handle, pipes_struct *p)
+uint32 _spoolss_abortprinter(pipes_struct *p, SPOOL_Q_ABORTPRINTER *q_u, SPOOL_R_ABORTPRINTER *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+
        return control_printer(handle, PRINTER_CONTROL_PURGE, p);
 }
 
@@ -3370,9 +4027,9 @@ static uint32 update_printer_sec(POLICY_HND *handle, uint32 level,
        uint32 result;
        int snum;
 
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
 
-       if (!OPEN_HANDLE(Printer) || !get_printer_snum(handle, &snum)) {
+       if (!Printer || !get_printer_snum(p, handle, &snum)) {
                DEBUG(0,("update_printer_sec: Invalid handle (%s)\n",
                         OUR_HANDLE(handle)));
 
@@ -3385,7 +4042,7 @@ static uint32 update_printer_sec(POLICY_HND *handle, uint32 level,
           dialog boxes when the user doesn't have permission to change
           the security descriptor. */
 
-       nt_printing_getsec(Printer->dev.handlename, &old_secdesc_ctr);
+       nt_printing_getsec(p->mem_ctx, Printer->dev.handlename, &old_secdesc_ctr);
 
        if (DEBUGLEVEL >= 10) {
                SEC_ACL *acl;
@@ -3423,7 +4080,7 @@ static uint32 update_printer_sec(POLICY_HND *handle, uint32 level,
                }
        }
 
-       new_secdesc_ctr = sec_desc_merge(secdesc_ctr, old_secdesc_ctr);
+       new_secdesc_ctr = sec_desc_merge(p->mem_ctx, secdesc_ctr, old_secdesc_ctr);
 
        if (sec_desc_equal(new_secdesc_ctr->sec, old_secdesc_ctr->sec)) {
                result = NT_STATUS_NO_PROBLEMO;
@@ -3447,8 +4104,6 @@ static uint32 update_printer_sec(POLICY_HND *handle, uint32 level,
        result = nt_printing_setsec(Printer->dev.handlename, new_secdesc_ctr);
 
  done:
-       free_sec_desc_buf(&new_secdesc_ctr);
-       free_sec_desc_buf(&old_secdesc_ctr);
 
        return result;
 }
@@ -3465,8 +4120,8 @@ static BOOL check_printer_ok(NT_PRINTER_INFO_LEVEL_2 *info, int snum)
                 info->servername, info->printername, info->sharename, info->portname, info->drivername, info->comment, info->location));
 
        /* we force some elements to "correct" values */
-       slprintf(info->servername, sizeof(info->servername), "\\\\%s", global_myname);
-       slprintf(info->printername, sizeof(info->printername), "\\\\%s\\%s",
+       slprintf(info->servername, sizeof(info->servername)-1, "\\\\%s", global_myname);
+       slprintf(info->printername, sizeof(info->printername)-1, "\\\\%s\\%s",
                 global_myname, lp_servicename(snum));
        fstrcpy(info->sharename, lp_servicename(snum));
        info->attributes = PRINTER_ATTRIBUTE_SHARED   \
@@ -3502,13 +4157,16 @@ static BOOL add_printer_hook(NT_PRINTER_INFO_LEVEL *printer)
        /* change \ to \\ for the shell */
        all_string_sub(driverlocation,"\\","\\\\",sizeof(pstring));
        
-       slprintf(tmp_file, sizeof(tmp_file), "%s/smbcmd.%d", path, local_pid);
-       slprintf(command, sizeof(command), "%s \"%s\" \"%s\" \"%s\" \"%s\" \"%s\" \"%s\"",
+       slprintf(tmp_file, sizeof(tmp_file)-1, "%s/smbcmd.%d", path, local_pid);
+       slprintf(command, sizeof(command)-1, "%s \"%s\" \"%s\" \"%s\" \"%s\" \"%s\" \"%s\"",
                        cmd, printer->info_2->printername, printer->info_2->sharename,
                        printer->info_2->portname, printer->info_2->drivername,
                        printer->info_2->location, driverlocation);
 
        unlink(tmp_file);
+
+    /* Convert script args to unix-codepage */
+    dos_to_unix(command, True);
        DEBUG(10,("Running [%s > %s]\n", command,tmp_file));
        ret = smbrun(command, tmp_file, False);
        DEBUGADD(10,("returned [%d]\n", ret));
@@ -3519,9 +4177,10 @@ static BOOL add_printer_hook(NT_PRINTER_INFO_LEVEL *printer)
        }
 
        numlines = 0;
+    /* Get lines and convert them back to dos-codepage */
        qlines = file_lines_load(tmp_file, &numlines, True);
        DEBUGADD(10,("Lines returned = [%d]\n", numlines));
-       DEBUGADD(10,("Unlinking port file [%s]\n", tmp_file));
+       DEBUGADD(10,("Unlinking script output file [%s]\n", tmp_file));
        unlink(tmp_file);
 
        if(numlines) {
@@ -3556,9 +4215,13 @@ static BOOL nt_devicemode_equal(NT_DEVICEMODE *d1, NT_DEVICEMODE *d2)
                return False; /* if either is exclusively NULL are not equal */
        }
 
-       if (!strequal(d1->devicename, d2->devicename) ||
-           !strequal(d1->formname, d2->formname)) {
-               DEBUG(10, ("nt_devicemode_equal(): device,form not equal\n"));
+       if (!strequal(d1->devicename, d2->devicename)) {
+               DEBUG(10, ("nt_devicemode_equal(): device not equal (%s != %s)\n", d1->devicename, d2->devicename));
+               return False;
+       }
+
+       if (!strequal(d1->formname, d2->formname)) {
+               DEBUG(10, ("nt_devicemode_equal(): formname not equal (%s != %s)\n", d1->formname, d2->formname));
                return False;
        }
 
@@ -3724,7 +4387,13 @@ static BOOL nt_printer_info_level_equal(NT_PRINTER_INFO_LEVEL *p1,
        pi1 = p1->info_2;
        pi2 = p2->info_2;
 
+       /* Don't check the attributes as we stomp on the value in
+          check_printer_ok() anyway. */
+
+#if 0
        PI_CHECK_INT(attributes);
+#endif
+
        PI_CHECK_INT(priority);
        PI_CHECK_INT(default_priority);
        PI_CHECK_INT(starttime);
@@ -3773,13 +4442,13 @@ static BOOL nt_printer_info_level_equal(NT_PRINTER_INFO_LEVEL *p1,
  * when updating a printer description
  ********************************************************************/
 
-static uint32 update_printer(POLICY_HND *handle, uint32 level,
+static uint32 update_printer(pipes_struct *p, POLICY_HND *handle, uint32 level,
                            const SPOOL_PRINTER_INFO_LEVEL *info,
                            DEVICEMODE *devmode)
 {
        int snum;
        NT_PRINTER_INFO_LEVEL *printer = NULL, *old_printer = NULL;
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
        uint32 result;
 
        DEBUG(8,("update_printer\n"));
@@ -3793,12 +4462,12 @@ static uint32 update_printer(POLICY_HND *handle, uint32 level,
                goto done;
        }
 
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                result = ERROR_INVALID_HANDLE;
                goto done;
        }
 
-       if (!get_printer_snum(handle, &snum)) {
+       if (!get_printer_snum(p, handle, &snum)) {
                result = ERROR_INVALID_HANDLE;
                goto done;
        }
@@ -3823,21 +4492,12 @@ static uint32 update_printer(POLICY_HND *handle, uint32 level,
                /* we have a valid devmode
                   convert it and link it*/
 
-               /*
-                * Ensure printer->info_2->devmode is a valid pointer
-                * as we will be overwriting it in convert_devicemode().
-                */
-               
-               if (printer->info_2->devmode == NULL)
-                       printer->info_2->devmode = construct_nt_devicemode(printer->info_2->printername);
-
                DEBUGADD(8,("Converting the devicemode struct\n"));
-               convert_devicemode(devmode, printer->info_2->devmode);
-
-       } else {
-               if (printer->info_2->devmode != NULL)
-                       free_nt_devicemode(&printer->info_2->devmode);
-               printer->info_2->devmode=NULL;
+               if (!convert_devicemode(printer->info_2->printername, devmode,
+                               &printer->info_2->devmode)) {
+                       result =  ERROR_NOT_ENOUGH_MEMORY;
+                       goto done;
+               }
        }
 
        /* Do sanity check on the requested changes for Samba */
@@ -3886,22 +4546,26 @@ static uint32 update_printer(POLICY_HND *handle, uint32 level,
        free_a_printer(&printer, 2);
        free_a_printer(&old_printer, 2);
 
-       srv_spoolss_sendnotify(handle);
+       srv_spoolss_sendnotify(p, handle);
 
        return result;
 }
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_setprinter(POLICY_HND *handle, uint32 level,
-                          const SPOOL_PRINTER_INFO_LEVEL *info,
-                          DEVMODE_CTR devmode_ctr,
-                          SEC_DESC_BUF *secdesc_ctr,
-                          uint32 command, pipes_struct *p)
+
+uint32 _spoolss_setprinter(pipes_struct *p, SPOOL_Q_SETPRINTER *q_u, SPOOL_R_SETPRINTER *r_u)
 {
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       POLICY_HND *handle = &q_u->handle;
+       uint32 level = q_u->level;
+       SPOOL_PRINTER_INFO_LEVEL *info = &q_u->info;
+       DEVMODE_CTR devmode_ctr = q_u->devmode_ctr;
+       SEC_DESC_BUF *secdesc_ctr = q_u->secdesc_ctr;
+       uint32 command = q_u->command;
+
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
        
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("_spoolss_setprinter: Invalid handle (%s)\n", OUR_HANDLE(handle)));
                return ERROR_INVALID_HANDLE;
        }
@@ -3911,7 +4575,7 @@ uint32 _spoolss_setprinter(POLICY_HND *handle, uint32 level,
                case 0:
                        return control_printer(handle, command, p);
                case 2:
-                       return update_printer(handle, level, info, devmode_ctr.devmode);
+                       return update_printer(p, handle, level, info, devmode_ctr.devmode);
                case 3:
                        return update_printer_sec(handle, level, info, p,
                                                  secdesc_ctr);
@@ -3922,27 +4586,27 @@ uint32 _spoolss_setprinter(POLICY_HND *handle, uint32 level,
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_fcpn(POLICY_HND *handle)
+
+uint32 _spoolss_fcpn(pipes_struct *p, SPOOL_Q_FCPN *q_u, SPOOL_R_FCPN *r_u)
 {
-       Printer_entry *Printer= find_printer_index_by_hnd(handle);
+       POLICY_HND *handle = &q_u->handle;
+
+       Printer_entry *Printer= find_printer_index_by_hnd(p, handle);
        
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("_spoolss_fcpn: Invalid handle (%s)\n", OUR_HANDLE(handle)));
                return ERROR_INVALID_HANDLE;
        }
 
        if (Printer->notify.client_connected==True)
-               if(!srv_spoolss_replycloseprinter(&Printer->notify.client_hnd))
-                       return ERROR_INVALID_HANDLE;
+               srv_spoolss_replycloseprinter(&Printer->notify.client_hnd);
 
        Printer->notify.flags=0;
        Printer->notify.options=0;
        Printer->notify.localmachine[0]='\0';
        Printer->notify.printerlocal=0;
        if (Printer->notify.option)
-               safe_free(Printer->notify.option->ctr.type);
-       safe_free(Printer->notify.option);
-       Printer->notify.option=NULL;
+               free_spool_notify_option(&Printer->notify.option);
        Printer->notify.client_connected=False;
 
        return NT_STATUS_NO_PROBLEMO;
@@ -3950,11 +4614,13 @@ uint32 _spoolss_fcpn(POLICY_HND *handle)
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_addjob(POLICY_HND *handle, uint32 level,
-                      NEW_BUFFER *buffer, uint32 offered,
-                      uint32 *needed)
+
+uint32 _spoolss_addjob(pipes_struct *p, SPOOL_Q_ADDJOB *q_u, SPOOL_R_ADDJOB *r_u)
 {
-       *needed = 0;
+       /* that's an [in out] buffer (despite appearences to the contrary) */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+
+       r_u->needed = 0;
        return ERROR_INVALID_PARAMETER; /* this is what a NT server
                                            returns for AddJob. AddJob
                                            must fail on non-local
@@ -3971,7 +4637,7 @@ static void fill_job_info_1(JOB_INFO_1 *job_info, print_queue_struct *queue,
        struct tm *t;
        
        t=gmtime(&queue->time);
-       snprintf(temp_name, sizeof(temp_name), "\\\\%s", global_myname);
+       slprintf(temp_name, sizeof(temp_name)-1, "\\\\%s", global_myname);
 
        job_info->jobid=queue->job;     
        init_unistr(&job_info->printername, lp_servicename(snum));
@@ -3992,22 +4658,19 @@ static void fill_job_info_1(JOB_INFO_1 *job_info, print_queue_struct *queue,
 /****************************************************************************
 ****************************************************************************/
 static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue,
-                            int position, int snum)
+                            int position, int snum, 
+                           NT_PRINTER_INFO_LEVEL *ntprinter)
 {
        pstring temp_name;
-       NT_PRINTER_INFO_LEVEL *ntprinter = NULL;
        pstring chaine;
        struct tm *t;
 
-       if (get_a_printer(&ntprinter, 2, lp_servicename(snum)) !=0 )
-               return False;
-       
        t=gmtime(&queue->time);
-       snprintf(temp_name, sizeof(temp_name), "\\\\%s", global_myname);
+       slprintf(temp_name, sizeof(temp_name)-1, "\\\\%s", global_myname);
 
        job_info->jobid=queue->job;
        
-       snprintf(chaine, sizeof(chaine)-1, "\\\\%s\\%s", global_myname, ntprinter->info_2->printername);
+       slprintf(chaine, sizeof(chaine)-1, "\\\\%s\\%s", global_myname, ntprinter->info_2->printername);
 
        init_unistr(&job_info->printername, chaine);
        
@@ -4035,11 +4698,9 @@ static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue,
        job_info->pagesprinted=0;
 
        if((job_info->devmode = construct_dev_mode(snum)) == NULL) {
-               free_a_printer(&ntprinter, 2);
                return False;
        }
 
-       free_a_printer(&ntprinter, 2);
        return (True);
 }
 
@@ -4096,19 +4757,25 @@ static uint32 enumjobs_level2(print_queue_struct *queue, int snum,
                              NEW_BUFFER *buffer, uint32 offered,
                              uint32 *needed, uint32 *returned)
 {
+       NT_PRINTER_INFO_LEVEL *ntprinter = NULL;
        JOB_INFO_2 *info;
        int i;
        
        info=(JOB_INFO_2 *)malloc(*returned*sizeof(JOB_INFO_2));
        if (info==NULL) {
-               safe_free(queue);
                *returned=0;
                return ERROR_NOT_ENOUGH_MEMORY;
        }
-       
+
+       if (get_a_printer(&ntprinter, 2, lp_servicename(snum)) !=0) {
+               *returned = 0;
+               return ERROR_NOT_ENOUGH_MEMORY;
+       }
+               
        for (i=0; i<*returned; i++)
-               fill_job_info_2(&(info[i]), &queue[i], i, snum);
+               fill_job_info_2(&(info[i]), &queue[i], i, snum, ntprinter);
 
+       free_a_printer(&ntprinter, 2);
        safe_free(queue);
 
        /* check the required size. */  
@@ -4125,7 +4792,10 @@ static uint32 enumjobs_level2(print_queue_struct *queue, int snum,
                new_smb_io_job_info_2("", buffer, &info[i], 0); 
 
        /* clear memory */
-       free_job_info_2(info);
+       for (i = 0; i < *returned; i++)
+               free_job_info_2(&info[i]);
+
+       free(info);
 
        if (*needed > offered) {
                *returned=0;
@@ -4138,14 +4808,26 @@ static uint32 enumjobs_level2(print_queue_struct *queue, int snum,
 /****************************************************************************
  Enumjobs.
 ****************************************************************************/
-uint32 _spoolss_enumjobs( POLICY_HND *handle, uint32 firstjob, uint32 numofjobs, uint32 level,                 
-                         NEW_BUFFER *buffer, uint32 offered,
-                         uint32 *needed, uint32 *returned)
+
+uint32 _spoolss_enumjobs( pipes_struct *p, SPOOL_Q_ENUMJOBS *q_u, SPOOL_R_ENUMJOBS *r_u)
 {      
+       POLICY_HND *handle = &q_u->handle;
+/*     uint32 firstjob = q_u->firstjob; - notused. */
+/*     uint32 numofjobs = q_u->numofjobs; - notused. */
+       uint32 level = q_u->level;
+       NEW_BUFFER *buffer = NULL;
+       uint32 offered = q_u->offered;
+       uint32 *needed = &r_u->needed;
+       uint32 *returned = &r_u->returned;
+
        int snum;
        print_queue_struct *queue=NULL;
        print_status_struct prt_status;
 
+       /* that's an [in out] buffer */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+       buffer = r_u->buffer;
+
        DEBUG(4,("_spoolss_enumjobs\n"));
 
        ZERO_STRUCT(prt_status);
@@ -4153,7 +4835,7 @@ uint32 _spoolss_enumjobs( POLICY_HND *handle, uint32 firstjob, uint32 numofjobs,
        *needed=0;
        *returned=0;
 
-       if (!get_printer_snum(handle, &snum))
+       if (!get_printer_snum(p, handle, &snum))
                return ERROR_INVALID_HANDLE;
 
        *returned = print_queue_status(snum, &queue, &prt_status);
@@ -4176,26 +4858,32 @@ uint32 _spoolss_enumjobs( POLICY_HND *handle, uint32 firstjob, uint32 numofjobs,
        }
 }
 
-
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_schedulejob( POLICY_HND *handle, uint32 jobid)
+
+uint32 _spoolss_schedulejob( pipes_struct *p, SPOOL_Q_SCHEDULEJOB *q_u, SPOOL_R_SCHEDULEJOB *r_u)
 {
        return 0x0;
 }
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_setjob(POLICY_HND *handle, uint32 jobid, uint32 level,
-                      pipes_struct *p, JOB_INFO *ctr, uint32 command)
+
+uint32 _spoolss_setjob(pipes_struct *p, SPOOL_Q_SETJOB *q_u, SPOOL_R_SETJOB *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+       uint32 jobid = q_u->jobid;
+/*     uint32 level = q_u->level; - notused. */
+/*     JOB_INFO *ctr = &q_u->ctr; - notused. */
+       uint32 command = q_u->command;
+
        struct current_user user;
        print_status_struct prt_status;
        int snum, errcode = ERROR_INVALID_FUNCTION;
                
        memset(&prt_status, 0, sizeof(prt_status));
 
-       if (!get_printer_snum(handle, &snum)) {
+       if (!get_printer_snum(p, handle, &snum)) {
                return ERROR_INVALID_HANDLE;
        }
 
@@ -4289,7 +4977,7 @@ static uint32 enumprinterdrivers_level1(fstring servername, fstring architecture
                return ERROR_INSUFFICIENT_BUFFER;
        }
 
-       /* fill the buffer with the form structures */
+       /* fill the buffer with the driver structures */
        for (i=0; i<*returned; i++) {
                DEBUGADD(6,("adding driver [%d] to buffer\n",i));
                new_smb_io_printer_driver_info_1("", buffer, &driver_info_1[i], 0);
@@ -4463,14 +5151,25 @@ static uint32 enumprinterdrivers_level3(fstring servername, fstring architecture
 /****************************************************************************
  Enumerates all printer drivers.
 ****************************************************************************/
-uint32 _spoolss_enumprinterdrivers( UNISTR2 *name, UNISTR2 *environment, uint32 level,
-                                   NEW_BUFFER *buffer, uint32 offered,
-                                   uint32 *needed, uint32 *returned)
+
+uint32 _spoolss_enumprinterdrivers( pipes_struct *p, SPOOL_Q_ENUMPRINTERDRIVERS *q_u, SPOOL_R_ENUMPRINTERDRIVERS *r_u)
 {
+/*     UNISTR2 *name = &q_u->name; - notused. */
+       UNISTR2 *environment = &q_u->environment;
+       uint32 level = q_u->level;
+       NEW_BUFFER *buffer = NULL;
+       uint32 offered = q_u->offered;
+       uint32 *needed = &r_u->needed;
+       uint32 *returned = &r_u->returned;
+
        fstring *list = NULL;
        fstring servername;
        fstring architecture;
 
+       /* that's an [in out] buffer */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+       buffer = r_u->buffer;
+
        DEBUG(4,("_spoolss_enumprinterdrivers\n"));
        fstrcpy(servername, global_myname);
        *needed=0;
@@ -4494,6 +5193,7 @@ uint32 _spoolss_enumprinterdrivers( UNISTR2 *name, UNISTR2 *environment, uint32
 
 /****************************************************************************
 ****************************************************************************/
+
 static void fill_form_1(FORM_1 *form, nt_forms_struct *list)
 {
        form->flag=list->flag;
@@ -4508,15 +5208,25 @@ static void fill_form_1(FORM_1 *form, nt_forms_struct *list)
        
 /****************************************************************************
 ****************************************************************************/
-uint32 _new_spoolss_enumforms( POLICY_HND *handle, uint32 level,
-                              NEW_BUFFER *buffer, uint32 offered,
-                              uint32 *needed, uint32 *numofforms)
+
+uint32 _new_spoolss_enumforms(pipes_struct *p, SPOOL_Q_ENUMFORMS *q_u, SPOOL_R_ENUMFORMS *r_u)
 {
+/*     POLICY_HND *handle = &q_u->handle; - notused. */
+       uint32 level = q_u->level;
+       NEW_BUFFER *buffer = NULL;
+       uint32 offered = q_u->offered;
+       uint32 *needed = &r_u->needed;
+       uint32 *numofforms = &r_u->numofforms;
+
        nt_forms_struct *list=NULL;
        FORM_1 *forms_1;
        int buffer_size=0;
        int i;
 
+       /* that's an [in out] buffer */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+       buffer = r_u->buffer;
+
        DEBUG(4,("_new_spoolss_enumforms\n"));
        DEBUGADD(5,("Offered buffer size [%d]\n", offered));
        DEBUGADD(5,("Info level [%d]\n",          level));
@@ -4578,14 +5288,26 @@ uint32 _new_spoolss_enumforms( POLICY_HND *handle, uint32 level,
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_getform( POLICY_HND *handle, uint32 level, UNISTR2 *uni_formname, NEW_BUFFER *buffer, uint32 offered, uint32 *needed)
+
+uint32 _spoolss_getform(pipes_struct *p, SPOOL_Q_GETFORM *q_u, SPOOL_R_GETFORM *r_u)
 {
+/*     POLICY_HND *handle = &q_u->handle; - notused. */
+       uint32 level = q_u->level;
+       UNISTR2 *uni_formname = &q_u->formname;
+       NEW_BUFFER *buffer = NULL;
+       uint32 offered = q_u->offered;
+       uint32 *needed = &r_u->needed;
+
        nt_forms_struct *list=NULL;
        FORM_1 form_1;
        fstring form_name;
        int buffer_size=0;
        int numofforms, i;
 
+       /* that's an [in out] buffer */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+       buffer = r_u->buffer;
+
        unistr2_to_ascii(form_name, uni_formname, sizeof(form_name)-1);
 
        DEBUG(4,("_spoolss_getform\n"));
@@ -4681,8 +5403,8 @@ static uint32 enumports_level_1(NEW_BUFFER *buffer, uint32 offered, uint32 *need
                else
                        path = tmpdir();
 
-               slprintf(tmp_file, sizeof(tmp_file), "%s/smbcmd.%d", path, local_pid);
-               slprintf(command, sizeof(command), "%s \"%d\"", cmd, 1);
+               slprintf(tmp_file, sizeof(tmp_file)-1, "%s/smbcmd.%d", path, local_pid);
+               slprintf(command, sizeof(command)-1, "%s \"%d\"", cmd, 1);
 
                unlink(tmp_file);
                DEBUG(10,("Running [%s > %s]\n", command,tmp_file));
@@ -4779,8 +5501,8 @@ static uint32 enumports_level_2(NEW_BUFFER *buffer, uint32 offered, uint32 *need
                else
                        path = tmpdir();
 
-               slprintf(tmp_file, sizeof(tmp_file), "%s/smbcmd.%d", path, local_pid);
-               slprintf(command, sizeof(command), "%s \"%d\"", cmd, 2);
+               slprintf(tmp_file, sizeof(tmp_file)-1, "%s/smbcmd.%d", path, local_pid);
+               slprintf(command, sizeof(command)-1, "%s \"%d\"", cmd, 2);
 
                unlink(tmp_file);
                DEBUG(10,("Running [%s > %s]\n", command,tmp_file));
@@ -4857,10 +5579,20 @@ static uint32 enumports_level_2(NEW_BUFFER *buffer, uint32 offered, uint32 *need
 /****************************************************************************
  enumports.
 ****************************************************************************/
-uint32 _spoolss_enumports( UNISTR2 *name, uint32 level,
-                          NEW_BUFFER *buffer, uint32 offered,
-                          uint32 *needed, uint32 *returned)
+
+uint32 _spoolss_enumports( pipes_struct *p, SPOOL_Q_ENUMPORTS *q_u, SPOOL_R_ENUMPORTS *r_u)
 {
+/*     UNISTR2 *name = &q_u->name; - notused. */
+       uint32 level = q_u->level;
+       NEW_BUFFER *buffer = NULL;
+       uint32 offered = q_u->offered;
+       uint32 *needed = &r_u->needed;
+       uint32 *returned = &r_u->returned;
+
+       /* that's an [in out] buffer */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+       buffer = r_u->buffer;
+
        DEBUG(4,("_spoolss_enumports\n"));
        
        *returned=0;
@@ -4878,7 +5610,7 @@ uint32 _spoolss_enumports( UNISTR2 *name, uint32 level,
 
 /****************************************************************************
 ****************************************************************************/
-static uint32 spoolss_addprinterex_level_2( const UNISTR2 *uni_srv_name,
+static uint32 spoolss_addprinterex_level_2( pipes_struct *p, const UNISTR2 *uni_srv_name,
                                const SPOOL_PRINTER_INFO_LEVEL *info,
                                uint32 unk0, uint32 unk1, uint32 unk2, uint32 unk3,
                                uint32 user_switch, const SPOOL_USER_CTR *user,
@@ -4933,7 +5665,7 @@ static uint32 spoolss_addprinterex_level_2( const UNISTR2 *uni_srv_name,
                return ERROR_ACCESS_DENIED;
        }
 
-       if (!open_printer_hnd(handle, name)) {
+       if (!open_printer_hnd(p, handle, name)) {
                /* Handle open failed - remove addition. */
                del_a_printer(printer->info_2->sharename);
                free_a_printer(&printer,2);
@@ -4942,26 +5674,34 @@ static uint32 spoolss_addprinterex_level_2( const UNISTR2 *uni_srv_name,
 
        free_a_printer(&printer,2);
 
-       srv_spoolss_sendnotify(handle);
+       srv_spoolss_sendnotify(p, handle);
 
        return NT_STATUS_NO_PROBLEMO;
 }
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_addprinterex( const UNISTR2 *uni_srv_name, uint32 level,
-                               const SPOOL_PRINTER_INFO_LEVEL *info,
-                               uint32 unk0, uint32 unk1, uint32 unk2, uint32 unk3,
-                               uint32 user_switch, const SPOOL_USER_CTR *user,
-                               POLICY_HND *handle)
+
+uint32 _spoolss_addprinterex( pipes_struct *p, SPOOL_Q_ADDPRINTEREX *q_u, SPOOL_R_ADDPRINTEREX *r_u)
 {
+       UNISTR2 *uni_srv_name = &q_u->server_name;
+       uint32 level = q_u->level;
+       SPOOL_PRINTER_INFO_LEVEL *info = &q_u->info;
+       uint32 unk0 = q_u->unk0;
+       uint32 unk1 = q_u->unk1;
+       uint32 unk2 = q_u->unk2;
+       uint32 unk3 = q_u->unk3;
+       uint32 user_switch = q_u->user_switch;
+       SPOOL_USER_CTR *user = &q_u->user_ctr;
+       POLICY_HND *handle = &r_u->handle;
+
        switch (level) {
                case 1:
                        /* we don't handle yet */
                        /* but I know what to do ... */
                        return ERROR_INVALID_LEVEL;
                case 2:
-                       return spoolss_addprinterex_level_2(uni_srv_name, info,
+                       return spoolss_addprinterex_level_2(p, uni_srv_name, info,
                                                            unk0, unk1, unk2, unk3,
                                                            user_switch, user, handle);
                default:
@@ -4971,9 +5711,13 @@ uint32 _spoolss_addprinterex( const UNISTR2 *uni_srv_name, uint32 level,
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_addprinterdriver(pipes_struct *p, const UNISTR2 *server_name,
-                                uint32 level, const SPOOL_PRINTER_DRIVER_INFO_LEVEL *info)
+
+uint32 _spoolss_addprinterdriver(pipes_struct *p, SPOOL_Q_ADDPRINTERDRIVER *q_u, SPOOL_R_ADDPRINTERDRIVER *r_u)
 {
+/*     UNISTR2 *server_name = &q_u->server_name; - notused. */
+       uint32 level = q_u->level;
+       SPOOL_PRINTER_DRIVER_INFO_LEVEL *info = &q_u->info;
+
        uint32 err = NT_STATUS_NO_PROBLEMO;
        NT_PRINTER_DRIVER_INFO_LEVEL driver;
        struct current_user user;
@@ -5054,10 +5798,20 @@ static uint32 getprinterdriverdir_level_1(UNISTR2 *name, UNISTR2 *uni_environmen
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_getprinterdriverdirectory(UNISTR2 *name, UNISTR2 *uni_environment, uint32 level,
-                                       NEW_BUFFER *buffer, uint32 offered,
-                                       uint32 *needed)
+
+uint32 _spoolss_getprinterdriverdirectory(pipes_struct *p, SPOOL_Q_GETPRINTERDRIVERDIR *q_u, SPOOL_R_GETPRINTERDRIVERDIR *r_u)
 {
+       UNISTR2 *name = &q_u->name;
+       UNISTR2 *uni_environment = &q_u->environment;
+       uint32 level = q_u->level;
+       NEW_BUFFER *buffer = NULL;
+       uint32 offered = q_u->offered;
+       uint32 *needed = &r_u->needed;
+
+       /* that's an [in out] buffer */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+       buffer = r_u->buffer;
+
        DEBUG(4,("_spoolss_getprinterdriverdirectory\n"));
 
        *needed=0;
@@ -5072,12 +5826,21 @@ uint32 _spoolss_getprinterdriverdirectory(UNISTR2 *name, UNISTR2 *uni_environmen
        
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_enumprinterdata(POLICY_HND *handle, uint32 idx,
-                               uint32 in_value_len, uint32 in_data_len,
-                               uint32 *out_max_value_len, uint16 **out_value, uint32 *out_value_len,
-                               uint32 *out_type,
-                               uint32 *out_max_data_len, uint8  **data_out, uint32 *out_data_len)
+
+uint32 _spoolss_enumprinterdata(pipes_struct *p, SPOOL_Q_ENUMPRINTERDATA *q_u, SPOOL_R_ENUMPRINTERDATA *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+       uint32 idx = q_u->index;
+       uint32 in_value_len = q_u->valuesize;
+       uint32 in_data_len = q_u->datasize;
+       uint32 *out_max_value_len = &r_u->valuesize;
+       uint16 **out_value = &r_u->value;
+       uint32 *out_value_len = &r_u->realvaluesize;
+       uint32 *out_type = &r_u->type;
+       uint32 *out_max_data_len = &r_u->datasize;
+       uint8  **data_out = &r_u->data;
+       uint32 *out_data_len = &r_u->realdatasize;
+
        NT_PRINTER_INFO_LEVEL *printer = NULL;
        
        fstring value;
@@ -5086,7 +5849,7 @@ uint32 _spoolss_enumprinterdata(POLICY_HND *handle, uint32 idx,
        uint32 biggest_valuesize;
        uint32 biggest_datasize;
        uint32 data_len;
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
        int snum;
        uint8 *data=NULL;
        uint32 type;
@@ -5105,12 +5868,12 @@ uint32 _spoolss_enumprinterdata(POLICY_HND *handle, uint32 idx,
 
        DEBUG(5,("spoolss_enumprinterdata\n"));
 
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("_spoolss_enumprinterdata: Invalid handle (%s).\n", OUR_HANDLE(handle)));
                return ERROR_INVALID_HANDLE;
        }
 
-       if (!get_printer_snum(handle, &snum))
+       if (!get_printer_snum(p,handle, &snum))
                return ERROR_INVALID_HANDLE;
        
        if (get_a_printer(&printer, 2, lp_servicename(snum)) != 0)
@@ -5204,24 +5967,22 @@ uint32 _spoolss_enumprinterdata(POLICY_HND *handle, uint32 idx,
         */
        
        *out_max_value_len=(in_value_len/sizeof(uint16));
-       if((*out_value=(uint16 *)malloc(in_value_len*sizeof(uint8))) == NULL) {
+       if((*out_value=(uint16 *)talloc_zero(p->mem_ctx,in_value_len*sizeof(uint8))) == NULL) {
                safe_free(data);
                return ERROR_NOT_ENOUGH_MEMORY;
        }
        
-       ZERO_STRUCTP(*out_value);
        *out_value_len = (uint32)dos_PutUniCode((char *)*out_value, value, in_value_len, True);
 
        *out_type=type;
 
        /* the data is counted in bytes */
        *out_max_data_len=in_data_len;
-       if((*data_out=(uint8 *)malloc(in_data_len*sizeof(uint8))) == NULL) {
+       if((*data_out=(uint8 *)talloc_zero(p->mem_ctx, in_data_len*sizeof(uint8))) == NULL) {
                safe_free(data);
                return ERROR_NOT_ENOUGH_MEMORY;
        }
        
-       memset(*data_out,'\0',in_data_len);
        memcpy(*data_out, data, (size_t)data_len);
        *out_data_len=data_len;
 
@@ -5232,28 +5993,31 @@ uint32 _spoolss_enumprinterdata(POLICY_HND *handle, uint32 idx,
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_setprinterdata( POLICY_HND *handle,
-                               const UNISTR2 *value,
-                               uint32 type,
-                               uint32 max_len,
-                               const uint8 *data,
-                               uint32 real_len,
-                               uint32 numeric_data)
+
+uint32 _spoolss_setprinterdata( pipes_struct *p, SPOOL_Q_SETPRINTERDATA *q_u, SPOOL_R_SETPRINTERDATA *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+       UNISTR2 *value = &q_u->value;
+       uint32 type = q_u->type;
+/*     uint32 max_len = q_u->max_len; - notused. */
+       uint8 *data = q_u->data;
+       uint32 real_len = q_u->real_len;
+/*     uint32 numeric_data = q_u->numeric_data; - notused. */
+
        NT_PRINTER_INFO_LEVEL *printer = NULL;
        NT_PRINTER_PARAM *param = NULL, old_param;
        int snum=0;
        uint32 status = 0x0;
-       Printer_entry *Printer=find_printer_index_by_hnd(handle);
+       Printer_entry *Printer=find_printer_index_by_hnd(p, handle);
        
        DEBUG(5,("spoolss_setprinterdata\n"));
 
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("_spoolss_setprinterdata: Invalid handle (%s).\n", OUR_HANDLE(handle)));
                return ERROR_INVALID_HANDLE;
        }
 
-       if (!get_printer_snum(handle, &snum))
+       if (!get_printer_snum(p,handle, &snum))
                return ERROR_INVALID_HANDLE;
 
        status = get_a_printer(&printer, 2, lp_servicename(snum));
@@ -5262,10 +6026,10 @@ uint32 _spoolss_setprinterdata( POLICY_HND *handle,
 
        convert_specific_param(&param, value , type, data, real_len);
 
-       /* Check if we are making any changes or not.  Return true if
+    /* Check if we are making any changes or not.  Return true if
           nothing is actually changing. */
-
-       ZERO_STRUCT(old_param);
+       
+    ZERO_STRUCT(old_param);
 
        if (get_specific_param(*printer, 2, param->value, &old_param.data,
                               &old_param.type, (unsigned int *)&old_param.data_len)) {
@@ -5306,27 +6070,31 @@ uint32 _spoolss_setprinterdata( POLICY_HND *handle,
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_deleteprinterdata( POLICY_HND *handle, const UNISTR2 *value)
+
+uint32 _spoolss_deleteprinterdata(pipes_struct *p, SPOOL_Q_DELETEPRINTERDATA *q_u, SPOOL_R_DELETEPRINTERDATA *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+       UNISTR2 *value = &q_u->valuename;
+
        NT_PRINTER_INFO_LEVEL *printer = NULL;
        NT_PRINTER_PARAM param;
        int snum=0;
        uint32 status = 0x0;
-       Printer_entry *Printer=find_printer_index_by_hnd(handle);
+       Printer_entry *Printer=find_printer_index_by_hnd(p, handle);
        
        DEBUG(5,("spoolss_deleteprinterdata\n"));
        
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("_spoolss_deleteprinterdata: Invalid handle (%s).\n", OUR_HANDLE(handle)));
                return ERROR_INVALID_HANDLE;
        }
 
-       if (!get_printer_snum(handle, &snum))
+       if (!get_printer_snum(p, handle, &snum))
                return ERROR_INVALID_HANDLE;
 
        if (!print_access_check(NULL, snum, PRINTER_ACCESS_ADMINISTER)) {
-               DEBUG(3, ("_spoolss_deleteprinterdata: security descriptor change denied by existing "
-                         "security descriptor\n"));
+               DEBUG(3, ("_spoolss_deleteprinterdata: printer properties "
+                         "change denied by existing security descriptor\n"));
                return ERROR_ACCESS_DENIED;
        }
 
@@ -5348,17 +6116,20 @@ uint32 _spoolss_deleteprinterdata( POLICY_HND *handle, const UNISTR2 *value)
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_addform( POLICY_HND *handle,
-                               uint32 level,
-                               const FORM *form)
+
+uint32 _spoolss_addform( pipes_struct *p, SPOOL_Q_ADDFORM *q_u, SPOOL_R_ADDFORM *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+/*     uint32 level = q_u->level; - notused. */
+       FORM *form = &q_u->form;
+
        int count=0;
        nt_forms_struct *list=NULL;
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
 
        DEBUG(5,("spoolss_addform\n"));
 
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("_spoolss_addform: Invalid handle (%s).\n", OUR_HANDLE(handle)));
                return ERROR_INVALID_HANDLE;
        }
@@ -5375,16 +6146,20 @@ uint32 _spoolss_addform( POLICY_HND *handle,
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_deleteform( POLICY_HND *handle, UNISTR2 *form_name)
+
+uint32 _spoolss_deleteform( pipes_struct *p, SPOOL_Q_DELETEFORM *q_u, SPOOL_R_DELETEFORM *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+       UNISTR2 *form_name = &q_u->name;
+
        int count=0;
        uint32 ret = 0;
        nt_forms_struct *list=NULL;
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
 
        DEBUG(5,("spoolss_deleteform\n"));
 
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("_spoolss_deleteform: Invalid handle (%s).\n", OUR_HANDLE(handle)));
                return ERROR_INVALID_HANDLE;
        }
@@ -5400,18 +6175,21 @@ uint32 _spoolss_deleteform( POLICY_HND *handle, UNISTR2 *form_name)
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_setform( POLICY_HND *handle,
-                               const UNISTR2 *uni_name,
-                               uint32 level,
-                               const FORM *form)
+
+uint32 _spoolss_setform(pipes_struct *p, SPOOL_Q_SETFORM *q_u, SPOOL_R_SETFORM *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+/*     UNISTR2 *uni_name = &q_u->name; - notused. */
+/*     uint32 level = q_u->level; - notused. */
+       FORM *form = &q_u->form;
+
        int count=0;
        nt_forms_struct *list=NULL;
-       Printer_entry *Printer = find_printer_index_by_hnd(handle);
+       Printer_entry *Printer = find_printer_index_by_hnd(p, handle);
 
        DEBUG(5,("spoolss_setform\n"));
 
-       if (!OPEN_HANDLE(Printer)) {
+       if (!Printer) {
                DEBUG(0,("_spoolss_setform: Invalid handle (%s).\n", OUR_HANDLE(handle)));
                return ERROR_INVALID_HANDLE;
        }
@@ -5457,10 +6235,21 @@ static uint32 enumprintprocessors_level_1(NEW_BUFFER *buffer, uint32 offered, ui
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_enumprintprocessors(UNISTR2 *name, UNISTR2 *environment, uint32 level,
-                                   NEW_BUFFER *buffer, uint32 offered,
-                                   uint32 *needed, uint32 *returned)
+
+uint32 _spoolss_enumprintprocessors(pipes_struct *p, SPOOL_Q_ENUMPRINTPROCESSORS *q_u, SPOOL_R_ENUMPRINTPROCESSORS *r_u)
 {
+/*     UNISTR2 *name = &q_u->name; - notused. */
+/*     UNISTR2 *environment = &q_u->environment; - notused. */
+       uint32 level = q_u->level;
+    NEW_BUFFER *buffer = NULL;
+       uint32 offered = q_u->offered;
+    uint32 *needed = &r_u->needed;
+       uint32 *returned = &r_u->returned;
+
+       /* that's an [in out] buffer */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+       buffer = r_u->buffer;
+
        DEBUG(5,("spoolss_enumprintprocessors\n"));
 
        /*
@@ -5514,10 +6303,21 @@ static uint32 enumprintprocdatatypes_level_1(NEW_BUFFER *buffer, uint32 offered,
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_enumprintprocdatatypes(UNISTR2 *name, UNISTR2 *processor, uint32 level,
-                                       NEW_BUFFER *buffer, uint32 offered,
-                                       uint32 *needed, uint32 *returned)
+
+uint32 _spoolss_enumprintprocdatatypes(pipes_struct *p, SPOOL_Q_ENUMPRINTPROCDATATYPES *q_u, SPOOL_R_ENUMPRINTPROCDATATYPES *r_u)
 {
+/*     UNISTR2 *name = &q_u->name; - notused. */
+/*     UNISTR2 *processor = &q_u->processor; - notused. */
+       uint32 level = q_u->level;
+       NEW_BUFFER *buffer = NULL;
+       uint32 offered = q_u->offered;
+       uint32 *needed = &r_u->needed;
+       uint32 *returned = &r_u->returned;
+
+       /* that's an [in out] buffer */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+       buffer = r_u->buffer;
+
        DEBUG(5,("_spoolss_enumprintprocdatatypes\n"));
        
        *returned=0;
@@ -5534,6 +6334,7 @@ uint32 _spoolss_enumprintprocdatatypes(UNISTR2 *name, UNISTR2 *processor, uint32
 /****************************************************************************
  enumprintmonitors level 1.
 ****************************************************************************/
+
 static uint32 enumprintmonitors_level_1(NEW_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned)
 {
        PRINTMONITOR_1 *info_1=NULL;
@@ -5597,10 +6398,20 @@ static uint32 enumprintmonitors_level_2(NEW_BUFFER *buffer, uint32 offered, uint
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_enumprintmonitors(UNISTR2 *name,uint32 level,
-                                   NEW_BUFFER *buffer, uint32 offered,
-                                   uint32 *needed, uint32 *returned)
+
+uint32 _spoolss_enumprintmonitors(pipes_struct *p, SPOOL_Q_ENUMPRINTMONITORS *q_u, SPOOL_R_ENUMPRINTMONITORS *r_u)
 {
+/*     UNISTR2 *name = &q_u->name; - notused. */
+       uint32 level = q_u->level;
+    NEW_BUFFER *buffer = NULL;
+       uint32 offered = q_u->offered;
+    uint32 *needed = &r_u->needed;
+       uint32 *returned = &r_u->returned;
+
+       /* that's an [in out] buffer */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+       buffer = r_u->buffer;
+
        DEBUG(5,("spoolss_enumprintmonitors\n"));
 
        /*
@@ -5679,6 +6490,8 @@ static uint32 getjob_level_2(print_queue_struct *queue, int count, int snum, uin
        int i=0;
        BOOL found=False;
        JOB_INFO_2 *info_2;
+       NT_PRINTER_INFO_LEVEL *ntprinter = NULL;
+
        info_2=(JOB_INFO_2 *)malloc(sizeof(JOB_INFO_2));
 
        ZERO_STRUCTP(info_2);
@@ -5700,8 +6513,14 @@ static uint32 getjob_level_2(print_queue_struct *queue, int count, int snum, uin
                return NT_STATUS_NO_PROBLEMO;
        }
        
-       fill_job_info_2(info_2, &(queue[i-1]), i, snum);
+       if (get_a_printer(&ntprinter, 2, lp_servicename(snum)) !=0) {
+               safe_free(queue);
+               return ERROR_NOT_ENOUGH_MEMORY;
+       }
+
+       fill_job_info_2(info_2, &(queue[i-1]), i, snum, ntprinter);
        
+       free_a_printer(&ntprinter, 2);
        safe_free(queue);
        
        *needed += spoolss_size_job_info_2(info_2);
@@ -5714,6 +6533,7 @@ static uint32 getjob_level_2(print_queue_struct *queue, int count, int snum, uin
        new_smb_io_job_info_2("", buffer, info_2, 0);
 
        free_job_info_2(info_2);
+       free(info_2);
 
        if (*needed > offered)
                return ERROR_INSUFFICIENT_BUFFER;
@@ -5723,22 +6543,32 @@ static uint32 getjob_level_2(print_queue_struct *queue, int count, int snum, uin
 
 /****************************************************************************
 ****************************************************************************/
-uint32 _spoolss_getjob( POLICY_HND *handle, uint32 jobid, uint32 level,
-                       NEW_BUFFER *buffer, uint32 offered,
-                       uint32 *needed)
+
+uint32 _spoolss_getjob( pipes_struct *p, SPOOL_Q_GETJOB *q_u, SPOOL_R_GETJOB *r_u)
 {
+       POLICY_HND *handle = &q_u->handle;
+       uint32 jobid = q_u->jobid;
+       uint32 level = q_u->level;
+       NEW_BUFFER *buffer = NULL;
+       uint32 offered = q_u->offered;
+       uint32 *needed = &r_u->needed;
+
        int snum;
        int count;
        print_queue_struct *queue=NULL;
        print_status_struct prt_status;
 
+       /* that's an [in out] buffer */
+       new_spoolss_move_buffer(q_u->buffer, &r_u->buffer);
+       buffer = r_u->buffer;
+
        DEBUG(5,("spoolss_getjob\n"));
        
        memset(&prt_status, 0, sizeof(prt_status));
 
        *needed=0;
        
-       if (!get_printer_snum(handle, &snum))
+       if (!get_printer_snum(p, handle, &snum))
                return ERROR_INVALID_HANDLE;
        
        count = print_queue_status(snum, &queue, &prt_status);
@@ -5756,4 +6586,3 @@ uint32 _spoolss_getjob( POLICY_HND *handle, uint32 jobid, uint32 level,
                return ERROR_INVALID_LEVEL;
        }
 }
-#undef OLD_NTDOMAIN