s3-spoolss: fix spoolss_EnumPrinterKey client and server code.

Guenther
(cherry picked from commit d464151f3b47c675664f464b1645ca85de663655)

diff --git a/source3/rpc_client/cli_spoolss.c b/source3/rpc_client/cli_spoolss.c
index 3f369bdab3c2de92f97d5599076d627427474a51..ff8736df9f61ad21edd1b05cf3789efab1723c27 100644 (file)
--- a/source3/rpc_client/cli_spoolss.c
+++ b/source3/rpc_client/cli_spoolss.c
@@ -760,27 +760,45 @@ WERROR rpccli_spoolss_enumprinterkey(struct rpc_pipe_client *cli,
        NTSTATUS status;
        WERROR werror;
        uint32_t needed;
+       uint16_t *buffer = NULL;
+
+       *key_buffer = NULL;
+
+       if (offered) {
+               buffer = talloc_array(mem_ctx, uint16_t, offered);
+               W_ERROR_HAVE_NO_MEMORY(buffer);
+       }
 
        status = rpccli_spoolss_EnumPrinterKey(cli, mem_ctx,
                                               handle,
                                               key_name,
-                                              key_buffer,
+                                              buffer,
                                               offered,
                                               &needed,
                                               &werror);
 
        if (W_ERROR_EQUAL(werror, WERR_MORE_DATA)) {
                offered = needed;
-
+               buffer = talloc_realloc(mem_ctx, buffer, uint16_t, needed);
+               W_ERROR_HAVE_NO_MEMORY(buffer);
                status = rpccli_spoolss_EnumPrinterKey(cli, mem_ctx,
                                                       handle,
                                                       key_name,
-                                                      key_buffer,
+                                                      buffer,
                                                       offered,
                                                       &needed,
                                                       &werror);
        }
 
+       if (W_ERROR_IS_OK(werror)) {
+               const char **array;
+               DATA_BLOB blob = data_blob_const((uint8_t *)buffer, offered);
+               if (!pull_reg_multi_sz(mem_ctx, &blob, &array)) {
+                       return WERR_NOMEM;
+               }
+               *key_buffer = array;
+       }
+
        return werror;
 }
 

diff --git a/source3/rpc_server/srv_spoolss_nt.c b/source3/rpc_server/srv_spoolss_nt.c
index 87735d330b2ef76ee5c920b5bfe3826271418b57..f0bf8513f22c8ea90262f0c4151f270401d7e628 100644 (file)
--- a/source3/rpc_server/srv_spoolss_nt.c
+++ b/source3/rpc_server/srv_spoolss_nt.c
@@ -9259,7 +9259,7 @@ WERROR _spoolss_EnumPrinterKey(pipes_struct *p,
        WERROR          result = WERR_BADFILE;
        int i;
        const char **array = NULL;
-
+       DATA_BLOB blob;
 
        DEBUG(4,("_spoolss_EnumPrinterKey\n"));
 
@@ -9288,7 +9288,9 @@ WERROR _spoolss_EnumPrinterKey(pipes_struct *p,
                goto done;
        }
 
-       *r->out.needed = 4;
+       /* two byte termination (a multisz) */
+
+       *r->out.needed = 2;
 
        array = talloc_zero_array(r->out.key_buffer, const char *, num_keys + 1);
        if (!array) {
@@ -9297,6 +9299,10 @@ WERROR _spoolss_EnumPrinterKey(pipes_struct *p,
        }
 
        for (i=0; i < num_keys; i++) {
+
+               DEBUG(10,("_spoolss_EnumPrinterKey: adding keyname: %s\n",
+                       keynames[i]));
+
                array[i] = talloc_strdup(array, keynames[i]);
                if (!array[i]) {
                        result = WERR_NOMEM;
@@ -9313,12 +9319,21 @@ WERROR _spoolss_EnumPrinterKey(pipes_struct *p,
 
        result = WERR_OK;
 
-       *r->out.key_buffer = array;
+       if (!push_reg_multi_sz(p->mem_ctx, &blob, array)) {
+               result = WERR_NOMEM;
+               goto done;
+       }
+
+       if (r->in.offered == blob.length) {
+               memcpy(r->out.key_buffer, blob.data, blob.length);
+       }
 
  done:
        if (!W_ERROR_IS_OK(result)) {
                TALLOC_FREE(array);
-               ZERO_STRUCTP(r->out.key_buffer);
+               if (!W_ERROR_EQUAL(result, WERR_MORE_DATA)) {
+                       *r->out.needed = 0;
+               }
        }
 
        free_a_printer(&printer, 2);