svn commit: samba r17244 - in branches: SAMBA_3_0/source/rpc_server
SAMBA_3_0_23/source/rpc_server
jra at samba.org
jra at samba.org
Tue Jul 25 21:23:34 GMT 2006
Author: jra
Date: 2006-07-25 21:23:34 +0000 (Tue, 25 Jul 2006)
New Revision: 17244
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=17244
Log:
There were several error paths where NT_PRINTER_INFO_LEVEL
wasn't being freed - also one enum jobs case where the
NT_PRINTER_INFO_LEVEL and queue weren't being freed.
Strange that Coverity or Klokwork didn't pick these up.
Hopefully will fix #3962.
Jeremy.
Modified:
branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c
branches/SAMBA_3_0_23/source/rpc_server/srv_spoolss_nt.c
Changeset:
Modified: branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c
===================================================================
--- branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c 2006-07-25 20:40:31 UTC (rev 17243)
+++ branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c 2006-07-25 21:23:34 UTC (rev 17244)
@@ -441,7 +441,7 @@
const char *servername;
fstring sname;
BOOL found=False;
- NT_PRINTER_INFO_LEVEL *printer;
+ NT_PRINTER_INFO_LEVEL *printer = NULL;
WERROR result;
DEBUG(4,("Setting printer name=%s (len=%lu)\n", handlename, (unsigned long)strlen(handlename)));
@@ -532,6 +532,7 @@
printername++;
if ( strequal(printername, aprinter) ) {
+ free_a_printer( &printer, 2);
found = True;
break;
}
@@ -541,6 +542,8 @@
free_a_printer( &printer, 2);
}
+ free_a_printer( &printer, 2);
+
if ( !found ) {
DEBUGADD(4,("Printer not found\n"));
return False;
@@ -3551,6 +3554,7 @@
if((info->data=SMB_REALLOC_ARRAY(info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1)) == NULL) {
DEBUG(2,("construct_notify_printer_info: failed to enlarge buffer info->data!\n"));
+ free_a_printer(&printer, 2);
return False;
}
@@ -4181,6 +4185,7 @@
*pp_printer = NULL;
if ((printer = SMB_MALLOC_P(PRINTER_INFO_3)) == NULL) {
DEBUG(2,("construct_printer_info_3: malloc fail.\n"));
+ free_a_printer(&ntprinter, 2);
return False;
}
@@ -4983,8 +4988,10 @@
if (!W_ERROR_IS_OK(get_a_printer(NULL, &printer, 2, lp_const_servicename(snum))))
return WERR_INVALID_PRINTER_NAME;
- if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version)))
+ if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version))) {
+ free_a_printer(&printer, 2);
return WERR_UNKNOWN_PRINTER_DRIVER;
+ }
fill_printer_driver_info_1(info, driver, servername, architecture);
@@ -5043,8 +5050,10 @@
if (!W_ERROR_IS_OK(get_a_printer(NULL, &printer, 2, lp_const_servicename(snum))))
return WERR_INVALID_PRINTER_NAME;
- if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version)))
+ if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version))) {
+ free_a_printer(&printer, 2);
return WERR_UNKNOWN_PRINTER_DRIVER;
+ }
fill_printer_driver_info_2(info, driver, servername);
@@ -6611,22 +6620,24 @@
if (*returned == 0) {
SAFE_FREE(queue);
+ free_a_printer(&ntprinter, 2);
return WERR_OK;
}
switch (level) {
case 1:
wret = enumjobs_level1(queue, snum, ntprinter, buffer, offered, needed, returned);
- return wret;
+ break;
case 2:
wret = enumjobs_level2(queue, snum, ntprinter, buffer, offered, needed, returned);
- return wret;
+ break;
default:
- SAFE_FREE(queue);
*returned=0;
wret = WERR_UNKNOWN_LEVEL;
+ break;
}
+ SAFE_FREE(queue);
free_a_printer( &ntprinter, 2 );
return wret;
}
Modified: branches/SAMBA_3_0_23/source/rpc_server/srv_spoolss_nt.c
===================================================================
--- branches/SAMBA_3_0_23/source/rpc_server/srv_spoolss_nt.c 2006-07-25 20:40:31 UTC (rev 17243)
+++ branches/SAMBA_3_0_23/source/rpc_server/srv_spoolss_nt.c 2006-07-25 21:23:34 UTC (rev 17244)
@@ -441,7 +441,7 @@
const char *servername;
fstring sname;
BOOL found=False;
- NT_PRINTER_INFO_LEVEL *printer;
+ NT_PRINTER_INFO_LEVEL *printer = NULL;
WERROR result;
DEBUG(4,("Setting printer name=%s (len=%lu)\n", handlename, (unsigned long)strlen(handlename)));
@@ -532,6 +532,7 @@
printername++;
if ( strequal(printername, aprinter) ) {
+ free_a_printer( &printer, 2);
found = True;
break;
}
@@ -541,6 +542,8 @@
free_a_printer( &printer, 2);
}
+ free_a_printer( &printer, 2);
+
if ( !found ) {
DEBUGADD(4,("Printer not found\n"));
return False;
@@ -3560,6 +3563,7 @@
if((info->data=SMB_REALLOC_ARRAY(info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1)) == NULL) {
DEBUG(2,("construct_notify_printer_info: failed to enlarge buffer info->data!\n"));
+ free_a_printer(&printer, 2);
return False;
}
@@ -4190,6 +4194,7 @@
*pp_printer = NULL;
if ((printer = SMB_MALLOC_P(PRINTER_INFO_3)) == NULL) {
DEBUG(2,("construct_printer_info_3: malloc fail.\n"));
+ free_a_printer(&ntprinter, 2);
return False;
}
@@ -4992,8 +4997,10 @@
if (!W_ERROR_IS_OK(get_a_printer(NULL, &printer, 2, lp_const_servicename(snum))))
return WERR_INVALID_PRINTER_NAME;
- if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version)))
+ if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version))) {
+ free_a_printer(&printer, 2);
return WERR_UNKNOWN_PRINTER_DRIVER;
+ }
fill_printer_driver_info_1(info, driver, servername, architecture);
@@ -5052,8 +5059,10 @@
if (!W_ERROR_IS_OK(get_a_printer(NULL, &printer, 2, lp_const_servicename(snum))))
return WERR_INVALID_PRINTER_NAME;
- if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version)))
+ if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version))) {
+ free_a_printer(&printer, 2);
return WERR_UNKNOWN_PRINTER_DRIVER;
+ }
fill_printer_driver_info_2(info, driver, servername);
@@ -6627,22 +6636,24 @@
if (*returned == 0) {
SAFE_FREE(queue);
+ free_a_printer(&ntprinter, 2);
return WERR_OK;
}
switch (level) {
case 1:
wret = enumjobs_level1(queue, snum, ntprinter, buffer, offered, needed, returned);
- return wret;
+ break;
case 2:
wret = enumjobs_level2(queue, snum, ntprinter, buffer, offered, needed, returned);
- return wret;
+ break;
default:
- SAFE_FREE(queue);
*returned=0;
wret = WERR_UNKNOWN_LEVEL;
+ break;
}
+ SAFE_FREE(queue);
free_a_printer( &ntprinter, 2 );
return wret;
}
More information about the samba-cvs
mailing list