CVE-2018-1050: s3: RPC: spoolss server. Protect against null pointer derefs.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11343

Signed-off-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c
index a3c3861202deb5fb2637518547d3db487eb4b1d2..fb56e2bf9a6b674be9de091309ca6a21fa1bc74c 100644 (file)
--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
@@ -178,6 +178,11 @@ static void prune_printername_cache(void);
 static const char *canon_servername(const char *servername)
 {
        const char *pservername = servername;
+
+       if (servername == NULL) {
+               return "";
+       }
+
        while (*pservername == '\\') {
                pservername++;
        }
@@ -2073,6 +2078,10 @@ WERROR _spoolss_DeletePrinterDriver(struct pipes_struct *p,
                return WERR_ACCESS_DENIED;
        }
 
+       if (r->in.architecture == NULL || r->in.driver == NULL) {
+               return WERR_INVALID_ENVIRONMENT;
+       }
+
        /* check that we have a valid driver name first */
 
        if ((version = get_version_id(r->in.architecture)) == -1) {
@@ -2212,6 +2221,10 @@ WERROR _spoolss_DeletePrinterDriverEx(struct pipes_struct *p,
                return WERR_ACCESS_DENIED;
        }
 
+       if (r->in.architecture == NULL || r->in.driver == NULL) {
+               return WERR_INVALID_ENVIRONMENT;
+       }
+
        /* check that we have a valid driver name first */
        if (get_version_id(r->in.architecture) == -1) {
                /* this is what NT returns */