spoolss: fix potential crash bug in spoolss_PrinterEnumValues push path.

Guenther

diff --git a/librpc/idl/spoolss.idl b/librpc/idl/spoolss.idl
index 028015b6967e90ed8951e7626eb649004c29ccb9..c61cba511ceb4b933547b42d14841ed022287de0 100644 (file)
--- a/librpc/idl/spoolss.idl
+++ b/librpc/idl/spoolss.idl
@@ -2855,7 +2855,7 @@ cpp_quote("#define spoolss_security_descriptor security_descriptor")
                [value(2*strlen_m_term(value_name))] uint32 value_name_len;
                winreg_Type type;
                [relative,subcontext(0),subcontext_size(data_length),flag(NDR_REMAINING)] DATA_BLOB *data;
-               [value(data->length)] uint32 data_length;
+               [value(data ? data->length : 0)] uint32 data_length;
        } spoolss_PrinterEnumValues;
 
        [public,noopnum,noprint] WERROR _spoolss_EnumPrinterDataEx(