s3:rpc_server: Fix undefined behavior from strchr

  o If no backslash was found in servername, variable asprinter will
    contain NULL value. It will then be passed to strchr call,
    resulting in undefined behavior.
  o Also rework code to remove const violation of handlename

Pair-Programmed-With: Dmitriy Mikhalchenko <tascad@altlinux.org>
Pair-Programmed-With: Noel Power <noel.power@suse.com>
Signed-off-by: Shishkov Nikita <shishkovna@sgu.ru>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Mon Jul 13 16:14:50 UTC 2026 on atb-devel-224

diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c
index 6759feb868e6ea616d8d32eb1c0e79f203259f04..56d62b109c61d3cf09660b3ed20a8308c86040bb 100644 (file)
--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
@@ -538,9 +538,9 @@ static WERROR set_printer_hnd_name(TALLOC_CTX *mem_ctx,
 {
        int snum;
        int n_services=lp_numservices();
-       char *aprinter;
+       char *aprinter = NULL;
        const char *printername;
-       const char *servername = NULL;
+       char *servername = NULL;
        fstring sname;
        bool found = false;
        struct spoolss_PrinterInfo2 *info2 = NULL;
@@ -558,13 +558,31 @@ static WERROR set_printer_hnd_name(TALLOC_CTX *mem_ctx,
        DEBUG(4,("Setting printer name=%s (len=%lu)\n", handlename,
                (unsigned long)strlen(handlename)));
 
-       aprinter = discard_const_p(char, handlename);
+       aprinter = talloc_strdup(mem_ctx, handlename);
+       if (aprinter == NULL) {
+               result = WERR_NOT_ENOUGH_MEMORY;
+               goto out;
+       }
+
        if ( *handlename == '\\' ) {
-               servername = canon_servername(handlename);
-               aprinter = discard_const_p(char, strchr_m(servername, '\\'));
-               if (aprinter != NULL) {
-                       *aprinter = '\0';
-                       aprinter++;
+               servername = talloc_strdup(mem_ctx,
+                                          canon_servername(handlename));
+               if (servername == NULL) {
+                       result = WERR_NOT_ENOUGH_MEMORY;
+                       goto out;
+               }
+
+               p = strchr_m(servername, '\\');
+
+               if (p != NULL) {
+                       TALLOC_FREE(aprinter);
+                       *p = '\0';
+                       p++;
+                       aprinter = talloc_strdup(mem_ctx, p);
+                       if (aprinter == NULL) {
+                               result = WERR_NOT_ENOUGH_MEMORY;
+                               goto out;
+                       }
                }
                if (!is_myname_or_ipaddr(servername)) {
                        result = WERR_INVALID_PRINTER_NAME;
@@ -719,6 +737,8 @@ static WERROR set_printer_hnd_name(TALLOC_CTX *mem_ctx,
 
        result = WERR_OK;
 out:
+       TALLOC_FREE(aprinter);
+       TALLOC_FREE(servername);
        return result;
 }