bug in get_current_user in rpc_server/srv_spoolss_nt.c

[Jeremy Allison]

Jim McDonough/Boulder/IBM wrote:
> 
> It looks like when get_current_user() was pulled into a function, both of
> the memcpy() calls got changed from
> memcpy(&user, ..., sizeof(user))
> to
> memcpy(user, ..., sizeof(user))
> 
> Since "user" was changed from "struct current_user" to "struct current_user
> *", I think the length of the memcpy should be changed to sizeof(struct
> current_user).
> 
> The symptom I got was that installing a new driver from an NT system would
> fail.  The files would go across, but trying to set the driver would fail
> on lookup of a uid of whatever happened to be in that space in memory.
> 
> Changing "sizeof(user) to sizeof(struct current_user) fixed the problem for
> me.

You're completely correct, thanks. Cut-n-paste finger
trouble :-(.

I've fixed it in 2.2.x and HEAD.

Thanks a lot,

	Jeremy.

-- 
--------------------------------------------------------
Buying an operating system without source is like buying
a self-assembly Space Shuttle with no instructions.
--------------------------------------------------------