spoolss: fix potential crash bug in spoolss_PrinterEnumValues push path.

Guenther
(cherry picked from commit 45952b56797982d27731b20d97f5648c9414814a)
(cherry picked from commit ad68e45b505331683a2510de20f113a7c20e68e1)

Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 5a660f3f15e1e04d556b34b9e49e7177193df026)

diff --git a/librpc/idl/spoolss.idl b/librpc/idl/spoolss.idl
index bfaca4a54616084d1a6707752d3da36479878380..44839be1bdc5de8cda9f6c0f0f08db32b79ca280 100644 (file)
--- a/librpc/idl/spoolss.idl
+++ b/librpc/idl/spoolss.idl
@@ -2551,7 +2551,7 @@ cpp_quote("#define spoolss_security_descriptor security_descriptor")
                [value(2*strlen_m_term(value_name))] uint32 value_name_len;
                winreg_Type type;
                [relative,subcontext(0),subcontext_size(data_length),flag(NDR_REMAINING)] DATA_BLOB *data;
-               [value(data->length)] uint32 data_length;
+               [value(data ? data->length : 0)] uint32 data_length;
        } spoolss_PrinterEnumValues;
 
        [public,noopnum,noprint] WERROR _spoolss_EnumPrinterDataEx(