r18330: don't mix pointer types in RPC replies

(This used to be commit cc86719f53a47e3ca25b19d7a765314ce967ab01)

diff --git a/source4/rpc_server/winreg/rpc_winreg.c b/source4/rpc_server/winreg/rpc_winreg.c
index 4dc07b9dc143cb5cd0a220588a2acf9710fb4e4e..17e711e23513118b7c7f6fba8809429ac282648e 100644 (file)
--- a/source4/rpc_server/winreg/rpc_winreg.c
+++ b/source4/rpc_server/winreg/rpc_winreg.c
@@ -399,7 +399,11 @@ static WERROR winreg_QueryValue(struct dcesrv_call_state *dce_call, TALLOC_CTX *
 
        /* Just asking for the size of the buffer */
        r->out.type = (enum winreg_Type *)&val->data_type;
-       r->out.length = &val->data.length;
+       r->out.length = talloc(mem_ctx, uint32_t);
+       if (!r->out.length) {
+               return WERR_NOMEM;
+       }
+       *r->out.length = val->data.length;
        if (!r->in.data) {
                r->out.size = talloc(mem_ctx, uint32_t);
                *r->out.size = val->data.length;