s3-spoolss: fix some crash bugs and missing error codes in AddDriver paths.

Found by torture test.

Guenther
(cherry picked from commit 413ffe9adb8eea488133da0249dcb2eca08fd69d)

Addresses bug #7459 (after upgrade to samba 3.4 and 3.5 lose ability to control duplex
for normal domain user).
(cherry picked from commit 286f4b53993fab0ffc53e5619e2987dfb13b0ec2)

diff --git a/source3/printing/nt_printing.c b/source3/printing/nt_printing.c
index fdcf2d4ce07a5a1c04178c7c38c2d1be2e5a0a9c..200a51a897b0dadb8e9f3b965dd4c3d67c9d67c7 100644 (file)
--- a/source3/printing/nt_printing.c
+++ b/source3/printing/nt_printing.c
@@ -1604,7 +1604,7 @@ static uint32 get_correct_cversion(struct pipes_struct *p,
 ****************************************************************************/
 
 #define strip_driver_path(_mem_ctx, _element) do { \
-       if ((_p = strrchr((_element), '\\')) != NULL) { \
+       if (_element && ((_p = strrchr((_element), '\\')) != NULL)) { \
                (_element) = talloc_asprintf((_mem_ctx), "%s", _p+1); \
                W_ERROR_HAVE_NO_MEMORY((_element)); \
        } \
@@ -1625,6 +1625,10 @@ static WERROR clean_up_driver_struct_level(TALLOC_CTX *mem_ctx,
        WERROR err;
        char *_p;
 
+       if (!*driver_path || !*data_file || !*config_file) {
+               return WERR_INVALID_PARAM;
+       }
+
        /* clean up the driver name.
         * we can get .\driver.dll
         * or worse c:\windows\system\driver.dll !
@@ -1634,7 +1638,9 @@ static WERROR clean_up_driver_struct_level(TALLOC_CTX *mem_ctx,
        strip_driver_path(mem_ctx, *driver_path);
        strip_driver_path(mem_ctx, *data_file);
        strip_driver_path(mem_ctx, *config_file);
-       strip_driver_path(mem_ctx, *help_file);
+       if (help_file) {
+               strip_driver_path(mem_ctx, *help_file);
+       }
 
        if (dependent_files && dependent_files->string) {
                for (i=0; dependent_files->string[i]; i++) {

diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index 2b1a64fc8ea5eb26d7586f1f50d5f31ce7e0da70..66538bcc8140172a3b542b05d81311aaea7e148b 100644 (file)
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -7417,6 +7417,10 @@ WERROR _spoolss_AddPrinterDriverEx(pipes_struct *p,
         * i.e. only copy files that are newer than existing ones
         */
 
+       if (r->in.flags == 0) {
+               return WERR_INVALID_PARAM;
+       }
+
        if (r->in.flags != APD_COPY_NEW_FILES) {
                return WERR_ACCESS_DENIED;
        }