From: Andreas Schneider <asn@samba.org>
Date: Wed, 28 Apr 2010 09:26:08 +0000 (+0200)
Subject: s3-spoolss: Fixed memory error in winreg_get_driver.
X-Git-Tag: samba-3.6.0pre1~2223
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3f0562f4b4cfe770baf2e529a445404a7b8f1141;p=thirdparty%2Fsamba.git

s3-spoolss: Fixed memory error in winreg_get_driver.

The strings in the structure need to be initialized with an empty
string.

Signed-off-by: Günther Deschner <gd@samba.org>
---

diff --git a/source3/rpc_server/srv_spoolss_util.c b/source3/rpc_server/srv_spoolss_util.c
index 3ddf7eb7151..995cb7becc9 100644
--- a/source3/rpc_server/srv_spoolss_util.c
+++ b/source3/rpc_server/srv_spoolss_util.c
@@ -30,6 +30,8 @@
 #define TOP_LEVEL_CONTROL_FORMS_KEY TOP_LEVEL_CONTROL_KEY "\\Forms"
 
 #define EMPTY_STRING ""
+static const char *empty_string_array[1] = { NULL };
+#define EMPTY_STRING_ARRAY empty_string_array
 
 #define CHECK_ERROR(result) \
 	if (W_ERROR_IS_OK(result)) continue; \
@@ -3654,11 +3656,42 @@ WERROR winreg_get_driver(TALLOC_CTX *mem_ctx,
 	}
 
 	info8 = talloc_zero(tmp_ctx, struct spoolss_DriverInfo8);
-	if (!info8) {
+	if (info8 == NULL) {
 		result = WERR_NOMEM;
 		goto done;
 	}
 
+	info8->driver_name = talloc_strdup(info8, driver_name);
+	if (info8->driver_name == NULL) {
+		result = WERR_NOMEM;
+		goto done;
+	}
+
+	info8->architecture = talloc_strdup(info8, architecture);
+	if (info8->architecture == NULL) {
+		result = WERR_NOMEM;
+		goto done;
+	}
+
+	info8->config_file = EMPTY_STRING;
+	info8->data_file = EMPTY_STRING;
+	info8->default_datatype = EMPTY_STRING;
+	info8->driver_path = EMPTY_STRING;
+	info8->hardware_id = EMPTY_STRING;
+	info8->help_file = EMPTY_STRING;
+	info8->inf_path = EMPTY_STRING;
+	info8->manufacturer_name = EMPTY_STRING;
+	info8->manufacturer_url = EMPTY_STRING;
+	info8->monitor_name = EMPTY_STRING;
+	info8->print_processor = EMPTY_STRING;
+	info8->provider = EMPTY_STRING;
+	info8->vendor_setup = EMPTY_STRING;
+
+	info8->color_profiles = empty_string_array;
+	info8->core_driver_dependencies = EMPTY_STRING_ARRAY;
+	info8->dependent_files = EMPTY_STRING_ARRAY;
+	info8->previous_names = EMPTY_STRING_ARRAY;
+
 	result = WERR_OK;
 
 	for (i = 0; i < num_values; i++) {