[SCM] Samba Shared Repository - branch master updated

[Günther Deschner]

The branch, master has been updated
       via  413ffe9... s3-spoolss: fix some crash bugs and missing error codes in AddDriver paths.
      from  f6bdfd9... s4-smbtorture: test both 32bit and 64bit driver uploads in RPC-SPOOLSS-DRIVER.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 413ffe9adb8eea488133da0249dcb2eca08fd69d
Author: Günther Deschner <gd at samba.org>
Date:   Fri Apr 23 02:34:43 2010 +0200

    s3-spoolss: fix some crash bugs and missing error codes in AddDriver paths.
    
    Found by torture test.
    
    Guenther

-----------------------------------------------------------------------

Summary of changes:
 source3/printing/nt_printing.c      |   10 ++++++++--
 source3/rpc_server/srv_spoolss_nt.c |    4 ++++
 2 files changed, 12 insertions(+), 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index a2d7e8c..56f5d18 100644
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -1605,7 +1605,7 @@ static uint32 get_correct_cversion(struct pipes_struct *p,
 ****************************************************************************/
 
 #define strip_driver_path(_mem_ctx, _element) do { \
-	if ((_p = strrchr((_element), '\\')) != NULL) { \
+	if (_element && ((_p = strrchr((_element), '\\')) != NULL)) { \
 		(_element) = talloc_asprintf((_mem_ctx), "%s", _p+1); \
 		W_ERROR_HAVE_NO_MEMORY((_element)); \
 	} \
@@ -1626,6 +1626,10 @@ static WERROR clean_up_driver_struct_level(TALLOC_CTX *mem_ctx,
 	WERROR err;
 	char *_p;
 
+	if (!*driver_path || !*data_file || !*config_file) {
+		return WERR_INVALID_PARAM;
+	}
+
 	/* clean up the driver name.
 	 * we can get .\driver.dll
 	 * or worse c:\windows\system\driver.dll !
@@ -1635,7 +1639,9 @@ static WERROR clean_up_driver_struct_level(TALLOC_CTX *mem_ctx,
 	strip_driver_path(mem_ctx, *driver_path);
 	strip_driver_path(mem_ctx, *data_file);
 	strip_driver_path(mem_ctx, *config_file);
-	strip_driver_path(mem_ctx, *help_file);
+	if (help_file) {
+		strip_driver_path(mem_ctx, *help_file);
+	}
 
 	if (dependent_files && dependent_files->string) {
 		for (i=0; dependent_files->string[i]; i++) {
diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index eec421f..72499d8 100644
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -7511,6 +7511,10 @@ WERROR _spoolss_AddPrinterDriverEx(pipes_struct *p,
 	 * i.e. only copy files that are newer than existing ones
 	 */
 
+	if (r->in.flags == 0) {
+		return WERR_INVALID_PARAM;
+	}
+
 	if (r->in.flags != APD_COPY_NEW_FILES) {
 		return WERR_ACCESS_DENIED;
 	}


-- 
Samba Shared Repository