source3/rpc_client: Fix NULL dereference in winreg_get_printer()

When dcerpc_winreg_enumvals() returns 0 values, the loop is skipped
but the error check still tries to dereference 'v' (which was never
initialized).

Add a guard to only check error status if num_values > 0, and reset
the result to WERR_OK on success to prevent spurious error handling.

Signed-off-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Martin Schwenke <martin@meltin.net>

diff --git a/source3/rpc_client/cli_winreg_spoolss.c b/source3/rpc_client/cli_winreg_spoolss.c
index ef698db00634f1cba430a3fd15375fa86bb6f6bd..88705c9577c07ae81e1355f0ffe9573fd368ebf0 100644 (file)
--- a/source3/rpc_client/cli_winreg_spoolss.c
+++ b/source3/rpc_client/cli_winreg_spoolss.c
@@ -1701,7 +1701,7 @@ WERROR winreg_get_printer(TALLOC_CTX *mem_ctx,
                CHECK_ERROR(result);
        }
 
-       if (!W_ERROR_IS_OK(result)) {
+       if (num_values > 0 && !W_ERROR_IS_OK(result)) {
                DEBUG(0, ("winreg_get_printer: winreg_enumval_to_TYPE() failed "
                                        "for %s: %s\n",
                                        v->value_name,
@@ -1709,6 +1709,8 @@ WERROR winreg_get_printer(TALLOC_CTX *mem_ctx,
                goto done;
        }
 
+       result = WERR_OK;
+
        /* Construct the Device Mode */
        status = dcerpc_winreg_query_binary(tmp_ctx,
                                            winreg_handle,