From: Stefan Metzmacher <metze@samba.org>
Date: Mon, 10 Jul 2017 09:29:58 +0000 (+0200)
Subject: s3:smbd: consistently use talloc_tos() memory for rpc_pipe_open_interface()
X-Git-Tag: samba-4.5.13~86
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=82f9cbab3444c547d38ca1900464e48e449a73ab;p=thirdparty%2Fsamba.git

s3:smbd: consistently use talloc_tos() memory for rpc_pipe_open_interface()

The result is only used temporary and should not be leaked on a long term
memory context as 'conn'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12890

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit 77cbced5d2f8bf65c8d02f5edfaba8cbad519d08)
---

diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c
index 53e2724805c..a376a593679 100644
--- a/source3/smbd/lanman.c
+++ b/source3/smbd/lanman.c
@@ -831,7 +831,7 @@ static bool api_DosPrintQGetInfo(struct smbd_server_connection *sconn,
 		goto out;
 	}
 
-	status = rpc_pipe_open_interface(conn,
+	status = rpc_pipe_open_interface(mem_ctx,
 					 &ndr_table_spoolss,
 					 conn->session_info,
 					 conn->sconn->remote_address,
@@ -1028,7 +1028,7 @@ static bool api_DosPrintQEnum(struct smbd_server_connection *sconn,
 		return(True);
 	}
 
-	status = rpc_pipe_open_interface(conn,
+	status = rpc_pipe_open_interface(mem_ctx,
 					 &ndr_table_spoolss,
 					 conn->session_info,
 					 conn->sconn->remote_address,
@@ -3140,7 +3140,7 @@ static bool api_RDosPrintJobDel(struct smbd_server_connection *sconn,
 
 	ZERO_STRUCT(handle);
 
-	status = rpc_pipe_open_interface(conn,
+	status = rpc_pipe_open_interface(mem_ctx,
 					 &ndr_table_spoolss,
 					 conn->session_info,
 					 conn->sconn->remote_address,
@@ -3268,7 +3268,7 @@ static bool api_WPrintQueueCtrl(struct smbd_server_connection *sconn,
 
 	ZERO_STRUCT(handle);
 
-	status = rpc_pipe_open_interface(conn,
+	status = rpc_pipe_open_interface(mem_ctx,
 					 &ndr_table_spoolss,
 					 conn->session_info,
 					 conn->sconn->remote_address,
@@ -3450,7 +3450,7 @@ static bool api_PrintJobInfo(struct smbd_server_connection *sconn,
 
 	ZERO_STRUCT(handle);
 
-	status = rpc_pipe_open_interface(conn,
+	status = rpc_pipe_open_interface(mem_ctx,
 					 &ndr_table_spoolss,
 					 conn->session_info,
 					 conn->sconn->remote_address,
@@ -4592,7 +4592,7 @@ static bool api_WPrintJobGetInfo(struct smbd_server_connection *sconn,
 
 	ZERO_STRUCT(handle);
 
-	status = rpc_pipe_open_interface(conn,
+	status = rpc_pipe_open_interface(mem_ctx,
 					 &ndr_table_spoolss,
 					 conn->session_info,
 					 conn->sconn->remote_address,
@@ -4734,7 +4734,7 @@ static bool api_WPrintJobEnumerate(struct smbd_server_connection *sconn,
 
 	ZERO_STRUCT(handle);
 
-	status = rpc_pipe_open_interface(conn,
+	status = rpc_pipe_open_interface(mem_ctx,
 					 &ndr_table_spoolss,
 					 conn->session_info,
 					 conn->sconn->remote_address,
@@ -4934,7 +4934,7 @@ static bool api_WPrintDestGetInfo(struct smbd_server_connection *sconn,
 
 	ZERO_STRUCT(handle);
 
-	status = rpc_pipe_open_interface(conn,
+	status = rpc_pipe_open_interface(mem_ctx,
 					 &ndr_table_spoolss,
 					 conn->session_info,
 					 conn->sconn->remote_address,
@@ -5066,7 +5066,7 @@ static bool api_WPrintDestEnum(struct smbd_server_connection *sconn,
 
 	queuecnt = 0;
 
-	status = rpc_pipe_open_interface(conn,
+	status = rpc_pipe_open_interface(mem_ctx,
 					 &ndr_table_spoolss,
 					 conn->session_info,
 					 conn->sconn->remote_address,
@@ -5377,7 +5377,7 @@ static bool api_RNetSessionEnum(struct smbd_server_connection *sconn,
 		return False;
 	}
 
-	status = rpc_pipe_open_interface(conn,
+	status = rpc_pipe_open_interface(mem_ctx,
 					 &ndr_table_srvsvc,
 					 conn->session_info,
 					 conn->sconn->remote_address,
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 6acbaca4165..82dcbba0c1d 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -5950,7 +5950,7 @@ void reply_printqueue(struct smb_request *req)
 
 		ZERO_STRUCT(handle);
 
-		status = rpc_pipe_open_interface(conn,
+		status = rpc_pipe_open_interface(mem_ctx,
 						 &ndr_table_spoolss,
 						 conn->session_info,
 						 conn->sconn->remote_address,