Author: jra Date: 2006-07-25 21:33:13 +0000 (Tue, 25 Jul 2006) New Revision: 17245
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=17245 Log: Second part of fix for #3962. Don't do a double free in the infolevel2 case. Free both queue and NT_PRINTER_INFO_LEVEL in the same place. Jeremy. Modified: branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c branches/SAMBA_3_0_23/source/rpc_server/srv_spoolss_nt.c Changeset: Modified: branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c =================================================================== --- branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c 2006-07-25 21:23:34 UTC (rev 17244) +++ branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c 2006-07-25 21:33:13 UTC (rev 17245) @@ -6395,9 +6395,9 @@ /**************************************************************************** ****************************************************************************/ -static void fill_job_info_1(JOB_INFO_1 *job_info, print_queue_struct *queue, +static void fill_job_info_1(JOB_INFO_1 *job_info, const print_queue_struct *queue, int position, int snum, - NT_PRINTER_INFO_LEVEL *ntprinter) + const NT_PRINTER_INFO_LEVEL *ntprinter) { struct tm *t; @@ -6422,9 +6422,9 @@ /**************************************************************************** ****************************************************************************/ -static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue, +static BOOL fill_job_info_2(JOB_INFO_2 *job_info, const print_queue_struct *queue, int position, int snum, - NT_PRINTER_INFO_LEVEL *ntprinter, + const NT_PRINTER_INFO_LEVEL *ntprinter, DEVICEMODE *devmode) { struct tm *t; @@ -6467,8 +6467,8 @@ Enumjobs at level 1. ****************************************************************************/ -static WERROR enumjobs_level1(print_queue_struct *queue, int snum, - NT_PRINTER_INFO_LEVEL *ntprinter, +static WERROR enumjobs_level1(const print_queue_struct *queue, int snum, + const NT_PRINTER_INFO_LEVEL *ntprinter, RPC_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned) { @@ -6478,7 +6478,6 @@ info=SMB_MALLOC_ARRAY(JOB_INFO_1,*returned); if (info==NULL) { - SAFE_FREE(queue); *returned=0; return WERR_NOMEM; } @@ -6486,8 +6485,6 @@ for (i=0; i<*returned; i++) fill_job_info_1( &info[i], &queue[i], i, snum, ntprinter ); - SAFE_FREE(queue); - /* check the required size. */ for (i=0; i<*returned; i++) (*needed) += spoolss_size_job_info_1(&info[i]); @@ -6520,8 +6517,8 @@ Enumjobs at level 2. ****************************************************************************/ -static WERROR enumjobs_level2(print_queue_struct *queue, int snum, - NT_PRINTER_INFO_LEVEL *ntprinter, +static WERROR enumjobs_level2(const print_queue_struct *queue, int snum, + const NT_PRINTER_INFO_LEVEL *ntprinter, RPC_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned) { @@ -6542,9 +6539,6 @@ for (i=0; i<*returned; i++) fill_job_info_2(&(info[i]), &queue[i], i, snum, ntprinter, devmode); - free_a_printer(&ntprinter, 2); - SAFE_FREE(queue); - /* check the required size. */ for (i=0; i<*returned; i++) (*needed) += spoolss_size_job_info_2(&info[i]); Modified: branches/SAMBA_3_0_23/source/rpc_server/srv_spoolss_nt.c =================================================================== --- branches/SAMBA_3_0_23/source/rpc_server/srv_spoolss_nt.c 2006-07-25 21:23:34 UTC (rev 17244) +++ branches/SAMBA_3_0_23/source/rpc_server/srv_spoolss_nt.c 2006-07-25 21:33:13 UTC (rev 17245) @@ -6411,9 +6411,9 @@ /**************************************************************************** ****************************************************************************/ -static void fill_job_info_1(JOB_INFO_1 *job_info, print_queue_struct *queue, +static void fill_job_info_1(JOB_INFO_1 *job_info, const print_queue_struct *queue, int position, int snum, - NT_PRINTER_INFO_LEVEL *ntprinter) + const NT_PRINTER_INFO_LEVEL *ntprinter) { struct tm *t; @@ -6438,9 +6438,9 @@ /**************************************************************************** ****************************************************************************/ -static BOOL fill_job_info_2(JOB_INFO_2 *job_info, print_queue_struct *queue, +static BOOL fill_job_info_2(JOB_INFO_2 *job_info, const print_queue_struct *queue, int position, int snum, - NT_PRINTER_INFO_LEVEL *ntprinter, + const NT_PRINTER_INFO_LEVEL *ntprinter, DEVICEMODE *devmode) { struct tm *t; @@ -6483,8 +6483,8 @@ Enumjobs at level 1. ****************************************************************************/ -static WERROR enumjobs_level1(print_queue_struct *queue, int snum, - NT_PRINTER_INFO_LEVEL *ntprinter, +static WERROR enumjobs_level1(const print_queue_struct *queue, int snum, + const NT_PRINTER_INFO_LEVEL *ntprinter, RPC_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned) { @@ -6494,7 +6494,6 @@ info=SMB_MALLOC_ARRAY(JOB_INFO_1,*returned); if (info==NULL) { - SAFE_FREE(queue); *returned=0; return WERR_NOMEM; } @@ -6502,8 +6501,6 @@ for (i=0; i<*returned; i++) fill_job_info_1( &info[i], &queue[i], i, snum, ntprinter ); - SAFE_FREE(queue); - /* check the required size. */ for (i=0; i<*returned; i++) (*needed) += spoolss_size_job_info_1(&info[i]); @@ -6536,8 +6533,8 @@ Enumjobs at level 2. ****************************************************************************/ -static WERROR enumjobs_level2(print_queue_struct *queue, int snum, - NT_PRINTER_INFO_LEVEL *ntprinter, +static WERROR enumjobs_level2(const print_queue_struct *queue, int snum, + const NT_PRINTER_INFO_LEVEL *ntprinter, RPC_BUFFER *buffer, uint32 offered, uint32 *needed, uint32 *returned) { @@ -6558,9 +6555,6 @@ for (i=0; i<*returned; i++) fill_job_info_2(&(info[i]), &queue[i], i, snum, ntprinter, devmode); - free_a_printer(&ntprinter, 2); - SAFE_FREE(queue); - /* check the required size. */ for (i=0; i<*returned; i++) (*needed) += spoolss_size_job_info_2(&info[i]);
