1 files changed, 29 insertions, 21 deletions

diff --git a/source/rpc_parse/parse_spoolss.c b/source/rpc_parse/parse_spoolss.c
index 458aed1fced..c7e6f97a5d6 100644
--- a/source/rpc_parse/parse_spoolss.c
+++ b/source/rpc_parse/parse_spoolss.c
@@ -778,6 +778,8 @@ BOOL make_spoolss_q_addprinterex(
 	
 	if (!ctr) return False;
 
+	ZERO_STRUCTP(q_u);
+
 	q_u->server_name_ptr = (srv_name!=NULL)?1:0;
 	init_unistr2(&q_u->server_name, srv_name, strlen(srv_name));
 
@@ -797,8 +799,6 @@ BOOL make_spoolss_q_addprinterex(
 			break;
 	}
 
-	q_u->unk0 = q_u->unk1 = q_u->unk2 = q_u->unk3 = 0;
-
 	q_u->user_switch=1;
 
 	q_u->user_ctr.level=1;
@@ -868,7 +868,6 @@ BOOL make_spoolss_printer_info_2(
 	init_unistr2_from_unistr(&inf->datatype, 	&info->datatype);
 	init_unistr2_from_unistr(&inf->parameters, 	&info->parameters);
 	init_unistr2_from_unistr(&inf->datatype, 	&info->datatype);
-	inf->secdesc 		= inf->secdesc;
 
 	*spool_info2 = inf;
 
@@ -4520,6 +4519,8 @@ BOOL spool_io_printer_info_level(char *desc, SPOOL_PRINTER_INFO_LEVEL *il, prs_s
 
 BOOL spoolss_io_q_addprinterex(char *desc, SPOOL_Q_ADDPRINTEREX *q_u, prs_struct *ps, int depth)
 {
+	uint32 ptr_sec_desc = 0;
+
 	prs_debug(ps, depth, desc, "spoolss_io_q_addprinterex");
 	depth++;
 
@@ -4539,26 +4540,33 @@ BOOL spoolss_io_q_addprinterex(char *desc, SPOOL_Q_ADDPRINTEREX *q_u, prs_struct
 	if(!spool_io_printer_info_level("", &q_u->info, ps, depth))
 		return False;
 	
-	/* the 4 unknown are all 0 */
-
-	/* 
-	 * en fait ils sont pas inconnu
-	 * par recoupement avec rpcSetPrinter
-	 * c'est le devicemode 
-	 * et le security descriptor.
-	 */
-	
-	if(!prs_align(ps))
-		return False;
-	if(!prs_uint32("unk0", ps, depth, &q_u->unk0))
-		return False;
-	if(!prs_uint32("unk1", ps, depth, &q_u->unk1))
-		return False;
-	if(!prs_uint32("unk2", ps, depth, &q_u->unk2))
-		return False;
-	if(!prs_uint32("unk3", ps, depth, &q_u->unk3))
+	if (!spoolss_io_devmode_cont(desc, &q_u->devmode_ctr, ps, depth))
 		return False;
 
+	switch (q_u->level) {
+		case 2:
+			ptr_sec_desc = q_u->info.info_2->secdesc_ptr;
+			break;
+		case 3:
+			ptr_sec_desc = q_u->info.info_3->secdesc_ptr;
+			break;
+	}
+	if (ptr_sec_desc) {
+		if (!sec_io_desc_buf(desc, &q_u->secdesc_ctr, ps, depth))
+			return False;
+	} else {
+		uint32 dummy;
+
+		/* Parse a NULL security descriptor.  This should really
+			happen inside the sec_io_desc_buf() function. */
+
+		prs_debug(ps, depth, "", "sec_io_desc_buf");
+		if (!prs_uint32("size", ps, depth + 1, &dummy))
+			return False;
+		if (!prs_uint32("ptr", ps, depth + 1, &dummy))
+			return False;
+	}
+
 	if(!prs_uint32("user_switch", ps, depth, &q_u->user_switch))
 		return False;
 	if(!spool_io_user_level("", &q_u->user_ctr, ps, depth))