Small patch for SPOOLSS pipe

Prevents a crash of the SAMBA 4 daemon on the torture SPOOLSS test due to not
initialised structures.

diff --git a/source4/rpc_server/spoolss/dcesrv_spoolss.c b/source4/rpc_server/spoolss/dcesrv_spoolss.c
index 7d14c0e50288e95579aec66ad5038b00186d060f..4e8544840c251905b4524dbdfb2711ad8721e9ed 100644 (file)
--- a/source4/rpc_server/spoolss/dcesrv_spoolss.c
+++ b/source4/rpc_server/spoolss/dcesrv_spoolss.c
@@ -575,11 +575,6 @@ static WERROR dcesrv_spoolss_GetPrinterData(struct dcesrv_call_state *dce_call,
        WERROR status;
        struct smb_iconv_convenience *ic = lp_iconv_convenience(dce_call->conn->dce_ctx->lp_ctx);
 
-       DCESRV_PULL_HANDLE_WERR(h, r->in.handle, DCESRV_HANDLE_ANY);
-       handle = talloc_get_type(h->data, struct ntptr_GenericHandle);
-       if (!handle)
-               return WERR_BADFID;
-
        r->out.type = talloc_zero(mem_ctx, enum winreg_Type);
        W_ERROR_HAVE_NO_MEMORY(r->out.type);
 
@@ -589,6 +584,11 @@ static WERROR dcesrv_spoolss_GetPrinterData(struct dcesrv_call_state *dce_call,
        r->out.data = talloc_zero(mem_ctx, union spoolss_PrinterData);
        W_ERROR_HAVE_NO_MEMORY(r->out.data);
 
+       DCESRV_PULL_HANDLE_WERR(h, r->in.handle, DCESRV_HANDLE_ANY);
+       handle = talloc_get_type(h->data, struct ntptr_GenericHandle);
+       if (!handle)
+               return WERR_BADFID;
+
        switch (handle->type) {
                case NTPTR_HANDLE_SERVER:
                        status = ntptr_GetPrintServerData(handle, mem_ctx, r);