Fixes from JF as I didn't understand the string array sizing code correctly.

Jeremy.

1 files changed, 17 insertions, 17 deletions

diff --git a/source/rpc_parse/parse_spoolss.c b/source/rpc_parse/parse_spoolss.c
index cb24a979387..bd4ce438366 100644
--- a/source/rpc_parse/parse_spoolss.c
+++ b/source/rpc_parse/parse_spoolss.c
@@ -2871,14 +2871,26 @@ uint32 spoolss_size_printer_driver_info_3(DRIVER_INFO_3 *info)
 	return size;
 }
 
+uint32 spoolss_size_string_array(uint16 *string)
+{
+	uint32 i = 0;
+
+	if (string) {
+		for (i=0; (string[i]!=0x0000) || (string[i+1]!=0x0000); i++);
+	}
+	i=i+2; /* to count all chars including the leading zero */
+	i=2*i; /* because we need the value in bytes */
+	i=i+4; /* the offset pointer size */
+
+	return i;
+}
+
 /*******************************************************************
 return the size required by a struct in the stream
 ********************************************************************/
 uint32 spoolss_size_printer_driver_info_6(DRIVER_INFO_6 *info)
 {
-	int size=0;
-	uint16 *string;
-	int i=0;
+	uint32 size=0;
 
 	size+=size_of_uint32( &info->version );	
 	size+=size_of_relative_string( &info->name );
@@ -2888,18 +2900,12 @@ uint32 spoolss_size_printer_driver_info_6(DRIVER_INFO_6 *info)
 	size+=size_of_relative_string( &info->configfile );
 	size+=size_of_relative_string( &info->helpfile );
 
-	string=info->dependentfiles;
-	if (string) {
-		for (i=0; (string[i]!=0x0000) || (string[i+1]!=0x0000); i++);
-	}
+	size+=spoolss_size_string_array(info->dependentfiles);
 
 	size+=size_of_relative_string( &info->monitorname );
 	size+=size_of_relative_string( &info->defaultdatatype );
 	
-	string=info->previousdrivernames;
-	if (string) {
-		for (i=0; (string[i]!=0x0000) || (string[i+1]!=0x0000); i++);
-	}
+	size+=spoolss_size_string_array(info->previousdrivernames);
 
 	size+=size_of_nttime(&info->driver_date);
 	size+=size_of_uint32( &info->driver_version );	
@@ -2908,12 +2914,6 @@ uint32 spoolss_size_printer_driver_info_6(DRIVER_INFO_6 *info)
 	size+=size_of_relative_string( &info->hardware_id );
 	size+=size_of_relative_string( &info->provider );
 
-	i=i+2; /* to count all chars including the leading zero */
-	i=2*i; /* because we need the value in bytes */
-	i=i+4; /* the offset pointer size */
-
-	size+=i;
-
 	return size;
 }