diff options
| author | David Disseldorp <ddiss@suse.de> | 2011-11-13 20:40:56 +0100 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2012-01-13 09:37:37 -0800 |
| commit | 0df5d0608e8aaa7dce2866d0c2cc4c27c677d98d (patch) | |
| tree | 073cccc73804a538291808b05e68ba61adf29658 | |
| parent | ee292bf5f342652b382a1926779f215f7f8bd806 (diff) | |
| download | samba-0df5d0608e8aaa7dce2866d0c2cc4c27c677d98d.tar.gz samba-0df5d0608e8aaa7dce2866d0c2cc4c27c677d98d.tar.xz samba-0df5d0608e8aaa7dce2866d0c2cc4c27c677d98d.zip | |
idl: add to_null attribute to the spoolss formname array
OpenPrinterEx requests have been observed in the wild carrying a device
mode formname "A4" followed by non-utf16 garbage after the null
terminator. Such requests currently fail during unmarshalling in the
ndr_pull_charset() codepath, causing intermittent print job failures.
This change ensures that garbage after the device mode formname null
terminator is not processed in unmarshalling.
https://bugzilla.samba.org/show_bug.cgi?id=8606
Signed-off-by: Jeremy Allison <jra@samba.org>
| -rw-r--r-- | librpc/idl/spoolss.idl | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/librpc/idl/spoolss.idl b/librpc/idl/spoolss.idl index 4599e3ac2e5..4b1f94f4a35 100644 --- a/librpc/idl/spoolss.idl +++ b/librpc/idl/spoolss.idl @@ -697,7 +697,7 @@ cpp_quote("#define spoolss_security_descriptor security_descriptor") uint16 yresolution; spoolss_DeviceModeTTOption ttoption; spoolss_DeviceModeCollate collate; - [charset(UTF16)] uint16 formname[MAXDEVICENAME]; + [charset(UTF16),to_null] uint16 formname[MAXDEVICENAME]; uint16 logpixels; /* reserved */ uint32 bitsperpel; /* reserved */ uint32 pelswidth; /* reserved */ |