s3-spoolss: Provide a memory context for clean_up_driver_struct().

If we use a stack variable to setup spoolss_AddDriverInfoCtr this would
segfault with a talloc bad magic value.

diff --git a/source3/include/proto.h b/source3/include/proto.h
index cd8d94261e2960c9957f0fc945ac4aa8c4af95a7..31a1d45a2721e871d7a78be45fb19a17468985ac 100644 (file)
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -4750,7 +4750,8 @@ bool delete_a_form(nt_forms_struct **list, const char *del_name, int *count, WER
 void update_a_form(nt_forms_struct **list, struct spoolss_AddFormInfo1 *form, int count);
 int get_ntdrivers(fstring **list, const char *architecture, uint32 version);
 const char *get_short_archi(const char *long_archi);
-WERROR clean_up_driver_struct(struct pipes_struct *rpc_pipe,
+WERROR clean_up_driver_struct(TALLOC_CTX *mem_ctx,
+                             struct pipes_struct *rpc_pipe,
                              struct spoolss_AddDriverInfoCtr *r);
 WERROR move_driver_to_download_area(struct pipes_struct *p,
                                    struct spoolss_AddDriverInfoCtr *r,

diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index c87cfc1fe39a7391f23a5f25fb9529dccb4a34bf..434311d665e56530a74ac1697c1572b52faeeb98 100644 (file)
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -1676,12 +1676,13 @@ static WERROR clean_up_driver_struct_level(TALLOC_CTX *mem_ctx,
 /****************************************************************************
 ****************************************************************************/
 
-WERROR clean_up_driver_struct(struct pipes_struct *rpc_pipe,
+WERROR clean_up_driver_struct(TALLOC_CTX *mem_ctx,
+                             struct pipes_struct *rpc_pipe,
                              struct spoolss_AddDriverInfoCtr *r)
 {
        switch (r->level) {
        case 3:
-               return clean_up_driver_struct_level(r, rpc_pipe,
+               return clean_up_driver_struct_level(mem_ctx, rpc_pipe,
                                                    r->info.info3->architecture,
                                                    &r->info.info3->driver_path,
                                                    &r->info.info3->data_file,
@@ -1690,7 +1691,7 @@ WERROR clean_up_driver_struct(struct pipes_struct *rpc_pipe,
                                                    r->info.info3->dependent_files,
                                                    &r->info.info3->version);
        case 6:
-               return clean_up_driver_struct_level(r, rpc_pipe,
+               return clean_up_driver_struct_level(mem_ctx, rpc_pipe,
                                                    r->info.info6->architecture,
                                                    &r->info.info6->driver_path,
                                                    &r->info.info6->data_file,

diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index e03bb348ea8db5334f7d257b00b81b2bb1ceff0e..6fd369562ab629a2b99a121a847701677d5417b8 100644 (file)
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -7377,7 +7377,7 @@ WERROR _spoolss_AddPrinterDriverEx(pipes_struct *p,
        }
 
        DEBUG(5,("Cleaning driver's information\n"));
-       err = clean_up_driver_struct(p, r->in.info_ctr);
+       err = clean_up_driver_struct(p->mem_ctx, p, r->in.info_ctr);
        if (!W_ERROR_IS_OK(err))
                goto done;