s3-spoolss: talloc_steal the returned driver_list in winreg_get_driver_list().

Otherwise the function would return a pointer to a freed list.

Guenther

diff --git a/source3/rpc_server/srv_spoolss_util.c b/source3/rpc_server/srv_spoolss_util.c
index 82882af2dc7e0f52d250632db7582de99439078c..ecb583c3e45ed726dd76238ec83409ab98f1f90f 100644 (file)
--- a/source3/rpc_server/srv_spoolss_util.c
+++ b/source3/rpc_server/srv_spoolss_util.c
@@ -4017,11 +4017,12 @@ WERROR winreg_get_driver_list(TALLOC_CTX *mem_ctx,
                              const char *architecture,
                              uint32_t version,
                              uint32_t *num_drivers,
-                             const char ***drivers)
+                             const char ***drivers_p)
 {
        uint32_t access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
        struct rpc_pipe_client *winreg_pipe = NULL;
        struct policy_handle hive_hnd, key_hnd;
+       const char **drivers;
        TALLOC_CTX *tmp_ctx;
        WERROR result;
 
@@ -4055,7 +4056,7 @@ WERROR winreg_get_driver_list(TALLOC_CTX *mem_ctx,
                                         winreg_pipe,
                                         &key_hnd,
                                         num_drivers,
-                                        drivers);
+                                        &drivers);
        if (!W_ERROR_IS_OK(result)) {
                DEBUG(0, ("winreg_get_driver_list: "
                          "Could not enumerate drivers for (%s,%u): %s\n",
@@ -4063,6 +4064,8 @@ WERROR winreg_get_driver_list(TALLOC_CTX *mem_ctx,
                goto done;
        }
 
+       *drivers_p = talloc_steal(mem_ctx, drivers);
+
        result = WERR_OK;
 done:
        if (winreg_pipe != NULL) {