Author: jra Date: 2006-07-25 21:23:34 +0000 (Tue, 25 Jul 2006) New Revision: 17244
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=17244 Log: There were several error paths where NT_PRINTER_INFO_LEVEL wasn't being freed - also one enum jobs case where the NT_PRINTER_INFO_LEVEL and queue weren't being freed. Strange that Coverity or Klokwork didn't pick these up. Hopefully will fix #3962. Jeremy. Modified: branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c branches/SAMBA_3_0_23/source/rpc_server/srv_spoolss_nt.c Changeset: Modified: branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c =================================================================== --- branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c 2006-07-25 20:40:31 UTC (rev 17243) +++ branches/SAMBA_3_0/source/rpc_server/srv_spoolss_nt.c 2006-07-25 21:23:34 UTC (rev 17244) @@ -441,7 +441,7 @@ const char *servername; fstring sname; BOOL found=False; - NT_PRINTER_INFO_LEVEL *printer; + NT_PRINTER_INFO_LEVEL *printer = NULL; WERROR result; DEBUG(4,("Setting printer name=%s (len=%lu)\n", handlename, (unsigned long)strlen(handlename))); @@ -532,6 +532,7 @@ printername++; if ( strequal(printername, aprinter) ) { + free_a_printer( &printer, 2); found = True; break; } @@ -541,6 +542,8 @@ free_a_printer( &printer, 2); } + free_a_printer( &printer, 2); + if ( !found ) { DEBUGADD(4,("Printer not found\n")); return False; @@ -3551,6 +3554,7 @@ if((info->data=SMB_REALLOC_ARRAY(info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1)) == NULL) { DEBUG(2,("construct_notify_printer_info: failed to enlarge buffer info->data!\n")); + free_a_printer(&printer, 2); return False; } @@ -4181,6 +4185,7 @@ *pp_printer = NULL; if ((printer = SMB_MALLOC_P(PRINTER_INFO_3)) == NULL) { DEBUG(2,("construct_printer_info_3: malloc fail.\n")); + free_a_printer(&ntprinter, 2); return False; } @@ -4983,8 +4988,10 @@ if (!W_ERROR_IS_OK(get_a_printer(NULL, &printer, 2, lp_const_servicename(snum)))) return WERR_INVALID_PRINTER_NAME; - if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version))) + if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version))) { + free_a_printer(&printer, 2); return WERR_UNKNOWN_PRINTER_DRIVER; + } fill_printer_driver_info_1(info, driver, servername, architecture); @@ -5043,8 +5050,10 @@ if (!W_ERROR_IS_OK(get_a_printer(NULL, &printer, 2, lp_const_servicename(snum)))) return WERR_INVALID_PRINTER_NAME; - if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version))) + if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version))) { + free_a_printer(&printer, 2); return WERR_UNKNOWN_PRINTER_DRIVER; + } fill_printer_driver_info_2(info, driver, servername); @@ -6611,22 +6620,24 @@ if (*returned == 0) { SAFE_FREE(queue); + free_a_printer(&ntprinter, 2); return WERR_OK; } switch (level) { case 1: wret = enumjobs_level1(queue, snum, ntprinter, buffer, offered, needed, returned); - return wret; + break; case 2: wret = enumjobs_level2(queue, snum, ntprinter, buffer, offered, needed, returned); - return wret; + break; default: - SAFE_FREE(queue); *returned=0; wret = WERR_UNKNOWN_LEVEL; + break; } + SAFE_FREE(queue); free_a_printer( &ntprinter, 2 ); return wret; } Modified: branches/SAMBA_3_0_23/source/rpc_server/srv_spoolss_nt.c =================================================================== --- branches/SAMBA_3_0_23/source/rpc_server/srv_spoolss_nt.c 2006-07-25 20:40:31 UTC (rev 17243) +++ branches/SAMBA_3_0_23/source/rpc_server/srv_spoolss_nt.c 2006-07-25 21:23:34 UTC (rev 17244) @@ -441,7 +441,7 @@ const char *servername; fstring sname; BOOL found=False; - NT_PRINTER_INFO_LEVEL *printer; + NT_PRINTER_INFO_LEVEL *printer = NULL; WERROR result; DEBUG(4,("Setting printer name=%s (len=%lu)\n", handlename, (unsigned long)strlen(handlename))); @@ -532,6 +532,7 @@ printername++; if ( strequal(printername, aprinter) ) { + free_a_printer( &printer, 2); found = True; break; } @@ -541,6 +542,8 @@ free_a_printer( &printer, 2); } + free_a_printer( &printer, 2); + if ( !found ) { DEBUGADD(4,("Printer not found\n")); return False; @@ -3560,6 +3563,7 @@ if((info->data=SMB_REALLOC_ARRAY(info->data, SPOOL_NOTIFY_INFO_DATA, info->count+1)) == NULL) { DEBUG(2,("construct_notify_printer_info: failed to enlarge buffer info->data!\n")); + free_a_printer(&printer, 2); return False; } @@ -4190,6 +4194,7 @@ *pp_printer = NULL; if ((printer = SMB_MALLOC_P(PRINTER_INFO_3)) == NULL) { DEBUG(2,("construct_printer_info_3: malloc fail.\n")); + free_a_printer(&ntprinter, 2); return False; } @@ -4992,8 +4997,10 @@ if (!W_ERROR_IS_OK(get_a_printer(NULL, &printer, 2, lp_const_servicename(snum)))) return WERR_INVALID_PRINTER_NAME; - if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version))) + if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version))) { + free_a_printer(&printer, 2); return WERR_UNKNOWN_PRINTER_DRIVER; + } fill_printer_driver_info_1(info, driver, servername, architecture); @@ -5052,8 +5059,10 @@ if (!W_ERROR_IS_OK(get_a_printer(NULL, &printer, 2, lp_const_servicename(snum)))) return WERR_INVALID_PRINTER_NAME; - if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version))) + if (!W_ERROR_IS_OK(get_a_printer_driver(&driver, 3, printer->info_2->drivername, architecture, version))) { + free_a_printer(&printer, 2); return WERR_UNKNOWN_PRINTER_DRIVER; + } fill_printer_driver_info_2(info, driver, servername); @@ -6627,22 +6636,24 @@ if (*returned == 0) { SAFE_FREE(queue); + free_a_printer(&ntprinter, 2); return WERR_OK; } switch (level) { case 1: wret = enumjobs_level1(queue, snum, ntprinter, buffer, offered, needed, returned); - return wret; + break; case 2: wret = enumjobs_level2(queue, snum, ntprinter, buffer, offered, needed, returned); - return wret; + break; default: - SAFE_FREE(queue); *returned=0; wret = WERR_UNKNOWN_LEVEL; + break; } + SAFE_FREE(queue); free_a_printer( &ntprinter, 2 ); return wret; }
