From ac42cd59f27de7d753fafd12b4c667073b8758c1 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Fri, 5 Aug 2005 00:58:31 +0000 Subject: r9086: * fix invalid read in parse_spoolss when writing a devmode to the wire * fix dup_a_regval() when size is 0 * ensure we pass a pstring to unlink_internals (fixes delete_driver code) (This used to be commit 353e63ff421c564a1b7c7cfe95982f31c871a227) --- source3/printing/nt_printing.c | 37 ++++++++++++++++++++++--------------- 1 file changed, 22 insertions(+), 15 deletions(-) (limited to 'source3/printing/nt_printing.c') diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c index a7ba46cd511..f6e9e2306f5 100644 --- a/source3/printing/nt_printing.c +++ b/source3/printing/nt_printing.c @@ -2102,19 +2102,20 @@ static WERROR get_a_printer_driver_3(NT_PRINTER_DRIVER_INFO_LEVEL_3 **info_ptr, fstring *tddfs; tddfs = SMB_REALLOC_ARRAY(driver.dependentfiles, fstring, i+2); - if (tddfs == NULL) { + if ( !tddfs ) { DEBUG(0,("get_a_printer_driver_3: failed to enlarge buffer!\n")); break; } - else driver.dependentfiles = tddfs; + else + driver.dependentfiles = tddfs; len += tdb_unpack(dbuf.dptr+len, dbuf.dsize-len, "f", &driver.dependentfiles[i]); i++; } - if (driver.dependentfiles != NULL) - fstrcpy(driver.dependentfiles[i], ""); + if ( driver.dependentfiles ) + fstrcpy( driver.dependentfiles[i], "" ); SAFE_FREE(dbuf.dptr); @@ -4944,6 +4945,7 @@ static BOOL delete_driver_files( NT_PRINTER_DRIVER_INFO_LEVEL_3 *info_3, struct { int i = 0; char *s; + pstring file; connection_struct *conn; DATA_BLOB null_pw; NTSTATUS nt_status; @@ -4985,45 +4987,50 @@ static BOOL delete_driver_files( NT_PRINTER_DRIVER_INFO_LEVEL_3 *info_3, struct if ( *info_3->driverpath ) { if ( (s = strchr( &info_3->driverpath[1], '\\' )) != NULL ) { - driver_unix_convert(s, conn, NULL, &bad_path, &st); + pstrcpy( file, s ); + driver_unix_convert(file, conn, NULL, &bad_path, &st); DEBUG(10,("deleting driverfile [%s]\n", s)); - unlink_internals(conn, 0, s); + unlink_internals(conn, 0, file); } } if ( *info_3->configfile ) { if ( (s = strchr( &info_3->configfile[1], '\\' )) != NULL ) { - driver_unix_convert(s, conn, NULL, &bad_path, &st); + pstrcpy( file, s ); + driver_unix_convert(file, conn, NULL, &bad_path, &st); DEBUG(10,("deleting configfile [%s]\n", s)); - unlink_internals(conn, 0, s); + unlink_internals(conn, 0, file); } } if ( *info_3->datafile ) { if ( (s = strchr( &info_3->datafile[1], '\\' )) != NULL ) { - driver_unix_convert(s, conn, NULL, &bad_path, &st); + pstrcpy( file, s ); + driver_unix_convert(file, conn, NULL, &bad_path, &st); DEBUG(10,("deleting datafile [%s]\n", s)); - unlink_internals(conn, 0, s); + unlink_internals(conn, 0, file); } } if ( *info_3->helpfile ) { if ( (s = strchr( &info_3->helpfile[1], '\\' )) != NULL ) { - driver_unix_convert(s, conn, NULL, &bad_path, &st); + pstrcpy( file, s ); + driver_unix_convert(file, conn, NULL, &bad_path, &st); DEBUG(10,("deleting helpfile [%s]\n", s)); - unlink_internals(conn, 0, s); + unlink_internals(conn, 0, file); } } /* check if we are done removing files */ if ( info_3->dependentfiles ) { - while ( *info_3->dependentfiles[i] ) { - char *file; + while ( info_3->dependentfiles[i][0] ) { + char *p; /* bypass the "\print$" portion of the path */ - if ( (file = strchr( info_3->dependentfiles[i]+1, '\\' )) != NULL ) { + if ( (p = strchr( info_3->dependentfiles[i]+1, '\\' )) != NULL ) { + pstrcpy( file, p ); driver_unix_convert(file, conn, NULL, &bad_path, &st); DEBUG(10,("deleting dependent file [%s]\n", file)); unlink_internals(conn, 0, file ); -- cgit