Fix bug #10100 - rpcclient crashes when sending the 'netshareenum 502' command

We are using the wrong variable for the returned count.
Reported by <pisymbol@gmail.com>.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Wed Aug 21 17:30:33 CEST 2013 on sn-devel-104

diff --git a/source3/rpcclient/cmd_srvsvc.c b/source3/rpcclient/cmd_srvsvc.c
index 0d67639959fc7490f3bd3a0f9017ae4a024647f7..e5fa0656737bd731d6e807e47c04af4a734530d9 100644 (file)
--- a/source3/rpcclient/cmd_srvsvc.c
+++ b/source3/rpcclient/cmd_srvsvc.c
@@ -273,6 +273,7 @@ static WERROR cmd_srvsvc_net_share_enum_int(struct rpc_pipe_client *cli,
        WERROR result;
        NTSTATUS status;
        uint32_t totalentries = 0;
+       uint32_t count = 0;
        uint32_t resume_handle = 0;
        uint32_t *resume_handle_p = NULL;
        uint32 preferred_len = 0xffffffff, i;
@@ -374,15 +375,18 @@ static WERROR cmd_srvsvc_net_share_enum_int(struct rpc_pipe_client *cli,
 
        switch (info_level) {
        case 1:
-               for (i = 0; i < totalentries; i++)
+               count = info_ctr.ctr.ctr1->count;
+               for (i = 0; i < count; i++)
                        display_share_info_1(&info_ctr.ctr.ctr1->array[i]);
                break;
        case 2:
-               for (i = 0; i < totalentries; i++)
+               count = info_ctr.ctr.ctr2->count;
+               for (i = 0; i < count; i++)
                        display_share_info_2(&info_ctr.ctr.ctr2->array[i]);
                break;
        case 502:
-               for (i = 0; i < totalentries; i++)
+               count = info_ctr.ctr.ctr502->count;
+               for (i = 0; i < count; i++)
                        display_share_info_502(&info_ctr.ctr.ctr502->array[i]);
                break;
        default: