Crash fixes:

 - fix a crash when a second NTLMSSP session tried to free the first
 - fix a crash due to some NULL pointers in the Add Printer Wizard (or read
   printer code too it appears).  As far as I can tell it's just that the
   GUID just might not exist.

Andrew Bartlett
(This used to be commit 51b1413056b0d001076ff47a755eb35baa2d9e6d)

diff --git a/source3/auth/auth_ntlmssp.c b/source3/auth/auth_ntlmssp.c
index f5e5c987ba59dca80197a401ecd0c3ba9460c559..f165322f7ae3de6d15d97654f3962b0af4e24793 100644 (file)
--- a/source3/auth/auth_ntlmssp.c
+++ b/source3/auth/auth_ntlmssp.c
@@ -58,6 +58,7 @@ NTSTATUS ntlmssp_server_end(NTLMSSP_STATE **ntlmssp_state)
        }
 
        talloc_destroy(mem_ctx);
+       *ntlmssp_state = NULL;
        return NT_STATUS_OK;
 }
 

diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index 72e3d38bb3adc1327093a9fd6393ba1f3333e6ff..73f1dd5f0d45130b2a7796002325787441993716 100644 (file)
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -2738,9 +2738,14 @@ BOOL is_printer_published(int snum, GUID *guid)
                                   SPOOL_DSSPOOLER_KEY)) < 0)
                return False;
 
-       ctr = &printer->info_2->data.keys[i].values;
+       if (!(ctr = &printer->info_2->data.keys[i].values)) {
+               return False;
+       }
+
+       if (!(guid_val = regval_ctr_getvalue(ctr, "objectGUID"))) {
+               return False;
+       }
 
-       guid_val = regval_ctr_getvalue(ctr, "objectGUID");
        if (regval_size(guid_val) == sizeof(GUID))
                memcpy(guid, regval_data_p(guid_val), sizeof(GUID));