The Samba-Bugzilla – Attachment 8240 Details for
Bug 9433
smbd/spoolss segfault with default devmode = no
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
tagged fix for v3-6-test
0001-spoolss-fix-segfault-when-default-devmode-is-disable_36t_tagged.patch (text/plain), 3.24 KB, created by
David Disseldorp
on 2012-11-29 13:01:03 UTC
(
hide
)
Description:
tagged fix for v3-6-test
Filename:
MIME Type:
Creator:
David Disseldorp
Created:
2012-11-29 13:01:03 UTC
Size:
3.24 KB
patch
obsolete
>From e647cebf64b6b1f43a95ae75aa8e25c224d0b034 Mon Sep 17 00:00:00 2001 >From: David Disseldorp <ddiss@samba.org> >Date: Tue, 27 Nov 2012 16:10:28 +0100 >Subject: [PATCH] spoolss: fix segfault when "default devmode" is disabled > >Currently when "default devmode" is explicitly disabled, and a printer >is added with a null device mode, spoolssd crashes in copy_devicemode(). > >Both construct_printer_info2() and construct_printer_info8() code paths >currently unconditionally attempt to copy a printers device mode, >without checking whether one is present. > >This change fixes this regression such that construct_printer_info*() >functions check for a null device mode before copying. > >https://bugzilla.samba.org/show_bug.cgi?id=9433 > >Reviewed-by: Andreas Schneider <asn@samba.org> >--- > source3/rpc_server/spoolss/srv_spoolss_nt.c | 52 +++++++++++++++++--------- > 1 files changed, 34 insertions(+), 18 deletions(-) > >diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c >index 8868a98..b5949e4 100644 >--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c >+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c >@@ -1942,24 +1942,12 @@ WERROR _spoolss_OpenPrinterEx(struct pipes_struct *p, > * save it here in case we get a job submission on this handle > */ > >- if ((Printer->printer_type != SPLHND_SERVER) && >- r->in.devmode_ctr.devmode) { >+ if ((Printer->printer_type != SPLHND_SERVER) >+ && (r->in.devmode_ctr.devmode != NULL)) { > copy_devicemode(NULL, r->in.devmode_ctr.devmode, > &Printer->devmode); > } > >-#if 0 /* JERRY -- I'm doubtful this is really effective */ >- /* HACK ALERT!!! Sleep for 1/3 of a second to try trigger a LAN/WAN >- optimization in Windows 2000 clients --jerry */ >- >- if ( (r->in.access_mask == PRINTER_ACCESS_ADMINISTER) >- && (RA_WIN2K == get_remote_arch()) ) >- { >- DEBUG(10,("_spoolss_OpenPrinterEx: Enabling LAN/WAN hack for Win2k clients.\n")); >- sys_usleep( 500000 ); >- } >-#endif >- > return WERR_OK; > } > >@@ -4037,8 +4025,22 @@ static WERROR construct_printer_info2(TALLOC_CTX *mem_ctx, > r->cjobs = count; > r->averageppm = info2->averageppm; > >- copy_devicemode(mem_ctx, info2->devmode, &r->devmode); >- if (!r->devmode) { >+ if (info2->devmode != NULL) { >+ result = copy_devicemode(mem_ctx, >+ info2->devmode, >+ &r->devmode); >+ if (!W_ERROR_IS_OK(result)) { >+ return result; >+ } >+ } else if (lp_default_devmode(snum)) { >+ result = spoolss_create_default_devmode(mem_ctx, >+ info2->printername, >+ &r->devmode); >+ if (!W_ERROR_IS_OK(result)) { >+ return result; >+ } >+ } else { >+ r->devmode = NULL; > DEBUG(8,("Returning NULL Devicemode!\n")); > } > >@@ -4218,8 +4220,22 @@ static WERROR construct_printer_info8(TALLOC_CTX *mem_ctx, > return result; > } > >- copy_devicemode(mem_ctx, info2->devmode, &r->devmode); >- if (!r->devmode) { >+ if (info2->devmode != NULL) { >+ result = copy_devicemode(mem_ctx, >+ info2->devmode, >+ &r->devmode); >+ if (!W_ERROR_IS_OK(result)) { >+ return result; >+ } >+ } else if (lp_default_devmode(snum)) { >+ result = spoolss_create_default_devmode(mem_ctx, >+ info2->printername, >+ &r->devmode); >+ if (!W_ERROR_IS_OK(result)) { >+ return result; >+ } >+ } else { >+ r->devmode = NULL; > DEBUG(8,("Returning NULL Devicemode!\n")); > } > >-- >1.7.1 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Flags:
asn
:
review+
Actions:
View
Attachments on
bug 9433
:
8231
|
8232
| 8240