--- source/python/py_spoolss.h.orig 2004-07-27 12:48:35.000000000 -0400 +++ source/python/py_spoolss.h 2004-07-27 12:46:45.000000000 -0400 @@ -67,7 +67,8 @@ BOOL py_from_DRIVER_INFO_2(PyObject **dict, DRIVER_INFO_2 *info); BOOL py_to_DRIVER_INFO_2(DRIVER_INFO_2 *info, PyObject *dict); BOOL py_from_DRIVER_INFO_3(PyObject **dict, DRIVER_INFO_3 *info); -BOOL py_to_DRIVER_INFO_3(*mem_ctx, DRIVER_INFO_3 *info, PyObject *dict); +BOOL py_to_DRIVER_INFO_3(TALLOC_CTX *mem_ctx, DRIVER_INFO_3 *info, + PyObject *dict); BOOL py_from_DRIVER_INFO_6(PyObject **dict, DRIVER_INFO_6 *info); BOOL py_to_DRIVER_INFO_6(DRIVER_INFO_6 *info, PyObject *dict); BOOL py_from_DRIVER_DIRECTORY_1(PyObject **dict, DRIVER_DIRECTORY_1 *info); --- source/python/py_spoolss_drivers.c.orig 2004-07-27 13:40:18.000000000 -0400 +++ source/python/py_spoolss_drivers.c 2004-07-27 13:38:47.000000000 -0400 @@ -367,7 +367,7 @@ case 3: ctr.info3 = &dinfo.driver_3; - if (!py_to_DRIVER_INFO_3(&dinfo.driver_3, info)) { + if (!py_to_DRIVER_INFO_3(mem_ctx, &dinfo.driver_3, info)) { PyErr_SetString(spoolss_error, "error converting to driver info 3"); goto done; --- source/python/py_spoolss_drivers_conv.c.orig 2004-07-26 11:07:04.000000000 -0400 +++ source/python/py_spoolss_drivers_conv.c 2004-07-27 13:46:14.000000000 -0400 @@ -78,9 +78,49 @@ { NULL } }; -static uint16 *to_dependentfiles(PyObject *dict) +static uint16 *to_dependentfiles(TALLOC_CTX *mem_ctx, PyObject *list) { - return (uint16 *)"abcd\0"; + uint32 elements, size=0, pos=0, i; + char *str; + uint16 *ret = NULL; + PyObject *borrowedRef; + + if (!PyList_Check(list)) { + goto done; + } + + /* calculate size for dependentfiles */ + elements=PyList_Size(list); + for (i = 0; i < elements; i++) { + borrowedRef=PyList_GetItem(list, i); + if (!PyString_Check(borrowedRef)) + /* non string found, return error */ + goto done; + size+=PyString_Size(borrowedRef)+1; + } + + if (!(ret = (uint16*) talloc(mem_ctx,(size+1)*sizeof(uint16)))) + goto done; + + /* create null terminated sequence of null terminated strings */ + for (i = 0; i < elements; i++) { + borrowedRef=PyList_GetItem(list, i); + str=PyString_AsString(borrowedRef); + do { + if (pos >= size) { + /* dependentfiles too small. miscalculated? */ + ret = NULL; + goto done; + } + SSVAL(&ret[pos], 0, str[0]); + pos++; + } while (*(str++)); + } + /* final null */ + ret[pos]='\0'; + +done: + return ret; } BOOL py_from_DRIVER_INFO_1(PyObject **dict, DRIVER_INFO_1 *info) @@ -122,16 +162,16 @@ return True; } -BOOL py_to_DRIVER_INFO_3(DRIVER_INFO_3 *info, PyObject *dict) +BOOL py_to_DRIVER_INFO_3(TALLOC_CTX *mem_ctx, DRIVER_INFO_3 *info, PyObject *dict) { PyObject *obj, *dict_copy = PyDict_Copy(dict); BOOL result = False; - if (!(obj = PyDict_GetItemString(dict_copy, "dependent_files")) || - !PyList_Check(obj)) + if (!(obj = PyDict_GetItemString(dict_copy, "dependent_files"))) goto done; - info->dependentfiles = to_dependentfiles(obj); + if (!(info->dependentfiles = to_dependentfiles(mem_ctx, obj))) + goto done; PyDict_DelItemString(dict_copy, "dependent_files");