?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix bug #7669.
[Samba.git] / source / smbd / ipc.c
blob8b6c88bbd4e54612380e8715c75ef68045c2a217
1 /*
2 Unix SMB/CIFS implementation.
3 Inter-process communication and named pipe handling
4 Copyright (C) Andrew Tridgell 1992-1998
5
6 SMB Version handling
7 Copyright (C) John H Terpstra 1995-1998
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles the named pipe and mailslot calls
24 in the SMBtrans protocol
25 */
26
27 #include "includes.h"
28
29 extern int max_send;
30
31 #define NERR_notsupported 50
32
33 static void api_no_reply(connection_struct *conn, struct smb_request *req);
34
35 /*******************************************************************
36 copies parameters and data, as needed, into the smb buffer
37
38 *both* the data and params sections should be aligned. this
39 is fudged in the rpc pipes by
40 at present, only the data section is. this may be a possible
41 cause of some of the ipc problems being experienced. lkcl26dec97
42
43 ******************************************************************/
44
45 static void copy_trans_params_and_data(char *outbuf, int align,
46 char *rparam, int param_offset, int param_len,
47 char *rdata, int data_offset, int data_len)
48 {
49 char *copy_into = smb_buf(outbuf);
50
51 if(param_len < 0)
52 param_len = 0;
53
54 if(data_len < 0)
55 data_len = 0;
56
57 DEBUG(5,("copy_trans_params_and_data: params[%d..%d] data[%d..%d] (align %d)\n",
58 param_offset, param_offset + param_len,
59 data_offset , data_offset + data_len,
60 align));
61
62 *copy_into = '\0';
63
64 copy_into += 1;
65
66 if (param_len)
67 memcpy(copy_into, &rparam[param_offset], param_len);
68
69 copy_into += param_len;
70 if (align) {
71 memset(copy_into, '\0', align);
72 }
73
74 copy_into += align;
75
76 if (data_len )
77 memcpy(copy_into, &rdata[data_offset], data_len);
78 }
79
80 /****************************************************************************
81 Send a trans reply.
82 ****************************************************************************/
83
84 void send_trans_reply(connection_struct *conn, const uint8_t *inbuf,
85 char *rparam, int rparam_len,
86 char *rdata, int rdata_len,
87 bool buffer_too_large)
88 {
89 int this_ldata,this_lparam;
90 int tot_data_sent = 0;
91 int tot_param_sent = 0;
92 int align;
93 char *outbuf;
94
95 int ldata = rdata ? rdata_len : 0;
96 int lparam = rparam ? rparam_len : 0;
97
98 if (buffer_too_large)
99 DEBUG(5,("send_trans_reply: buffer %d too large\n", ldata ));
100
101 this_lparam = MIN(lparam,max_send - 500); /* hack */
102 this_ldata = MIN(ldata,max_send - (500+this_lparam));
103
104 align = ((this_lparam)%4);
105
106 if (!create_outbuf(talloc_tos(), (char *)inbuf, &outbuf,
107 10, 1+align+this_ldata+this_lparam)) {
108 smb_panic("could not allocate outbuf");
109 }
110
111 copy_trans_params_and_data(outbuf, align,
112 rparam, tot_param_sent, this_lparam,
113 rdata, tot_data_sent, this_ldata);
114
115 SSVAL(outbuf,smb_vwv0,lparam);
116 SSVAL(outbuf,smb_vwv1,ldata);
117 SSVAL(outbuf,smb_vwv3,this_lparam);
118 SSVAL(outbuf,smb_vwv4,smb_offset(smb_buf(outbuf)+1,outbuf));
119 SSVAL(outbuf,smb_vwv5,0);
120 SSVAL(outbuf,smb_vwv6,this_ldata);
121 SSVAL(outbuf,smb_vwv7,smb_offset(smb_buf(outbuf)+1+this_lparam+align,
122 outbuf));
123 SSVAL(outbuf,smb_vwv8,0);
124 SSVAL(outbuf,smb_vwv9,0);
125
126 if (buffer_too_large) {
127 error_packet_set((char *)outbuf, ERRDOS, ERRmoredata,
128 STATUS_BUFFER_OVERFLOW, __LINE__, __FILE__);
129 }
130
131 show_msg(outbuf);
132 if (!srv_send_smb(smbd_server_fd(), (char *)outbuf,
133 IS_CONN_ENCRYPTED(conn))) {
134 exit_server_cleanly("send_trans_reply: srv_send_smb failed.");
135 }
136
137 TALLOC_FREE(outbuf);
138
139 tot_data_sent = this_ldata;
140 tot_param_sent = this_lparam;
141
142 while (tot_data_sent < ldata || tot_param_sent < lparam)
143 {
144 this_lparam = MIN(lparam-tot_param_sent,
145 max_send - 500); /* hack */
146 this_ldata = MIN(ldata -tot_data_sent,
147 max_send - (500+this_lparam));
148
149 if(this_lparam < 0)
150 this_lparam = 0;
151
152 if(this_ldata < 0)
153 this_ldata = 0;
154
155 align = (this_lparam%4);
156
157 if (!create_outbuf(talloc_tos(), (char *)inbuf, &outbuf,
158 10, 1+align+this_ldata+this_lparam)) {
159 smb_panic("could not allocate outbuf");
160 }
161
162 copy_trans_params_and_data(outbuf, align,
163 rparam, tot_param_sent, this_lparam,
164 rdata, tot_data_sent, this_ldata);
165
166 SSVAL(outbuf,smb_vwv0,lparam);
167 SSVAL(outbuf,smb_vwv1,ldata);
168
169 SSVAL(outbuf,smb_vwv3,this_lparam);
170 SSVAL(outbuf,smb_vwv4,smb_offset(smb_buf(outbuf)+1,outbuf));
171 SSVAL(outbuf,smb_vwv5,tot_param_sent);
172 SSVAL(outbuf,smb_vwv6,this_ldata);
173 SSVAL(outbuf,smb_vwv7,
174 smb_offset(smb_buf(outbuf)+1+this_lparam+align, outbuf));
175 SSVAL(outbuf,smb_vwv8,tot_data_sent);
176 SSVAL(outbuf,smb_vwv9,0);
177
178 if (buffer_too_large) {
179 error_packet_set(outbuf, ERRDOS, ERRmoredata,
180 STATUS_BUFFER_OVERFLOW,
181 __LINE__, __FILE__);
182 }
183
184 show_msg(outbuf);
185 if (!srv_send_smb(smbd_server_fd(), outbuf,
186 IS_CONN_ENCRYPTED(conn)))
187 exit_server_cleanly("send_trans_reply: srv_send_smb "
188 "failed.");
189
190 tot_data_sent += this_ldata;
191 tot_param_sent += this_lparam;
192 TALLOC_FREE(outbuf);
193 }
194 }
195
196 /****************************************************************************
197 Start the first part of an RPC reply which began with an SMBtrans request.
198 ****************************************************************************/
199
200 static void api_rpc_trans_reply(connection_struct *conn, struct smb_request *req, smb_np_struct *p)
201 {
202 bool is_data_outstanding;
203 char *rdata = (char *)SMB_MALLOC(p->max_trans_reply);
204 int data_len;
205
206 if(rdata == NULL) {
207 DEBUG(0,("api_rpc_trans_reply: malloc fail.\n"));
208 reply_nterror(req, NT_STATUS_NO_MEMORY);
209 return;
210 }
211
212 if((data_len = read_from_pipe( p, rdata, p->max_trans_reply,
213 &is_data_outstanding)) < 0) {
214 SAFE_FREE(rdata);
215 api_no_reply(conn,req);
216 return;
217 }
218
219 send_trans_reply(conn, req->inbuf, NULL, 0, rdata, data_len,
220 is_data_outstanding);
221 SAFE_FREE(rdata);
222 return;
223 }
224
225 /****************************************************************************
226 WaitNamedPipeHandleState
227 ****************************************************************************/
228
229 static void api_WNPHS(connection_struct *conn, struct smb_request *req, smb_np_struct *p,
230 char *param, int param_len)
231 {
232 uint16 priority;
233
234 if (!param || param_len < 2) {
235 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
236 return;
237 }
238
239 priority = SVAL(param,0);
240 DEBUG(4,("WaitNamedPipeHandleState priority %x\n", priority));
241
242 if (wait_rpc_pipe_hnd_state(p, priority)) {
243 /* now send the reply */
244 send_trans_reply(conn, req->inbuf, NULL, 0, NULL, 0, False);
245 return;
246 }
247 api_no_reply(conn,req);
248 }
249
250
251 /****************************************************************************
252 SetNamedPipeHandleState
253 ****************************************************************************/
254
255 static void api_SNPHS(connection_struct *conn, struct smb_request *req, smb_np_struct *p,
256 char *param, int param_len)
257 {
258 uint16 id;
259
260 if (!param || param_len < 2) {
261 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
262 return;
263 }
264
265 id = SVAL(param,0);
266 DEBUG(4,("SetNamedPipeHandleState to code %x\n", id));
267
268 if (set_rpc_pipe_hnd_state(p, id)) {
269 /* now send the reply */
270 send_trans_reply(conn, req->inbuf, NULL, 0, NULL, 0, False);
271 return;
272 }
273 api_no_reply(conn,req);
274 }
275
276
277 /****************************************************************************
278 When no reply is generated, indicate unsupported.
279 ****************************************************************************/
280
281 static void api_no_reply(connection_struct *conn, struct smb_request *req)
282 {
283 char rparam[4];
284
285 /* unsupported */
286 SSVAL(rparam,0,NERR_notsupported);
287 SSVAL(rparam,2,0); /* converter word */
288
289 DEBUG(3,("Unsupported API fd command\n"));
290
291 /* now send the reply */
292 send_trans_reply(conn, req->inbuf, rparam, 4, NULL, 0, False);
293
294 return;
295 }
296
297 /****************************************************************************
298 Handle remote api calls delivered to a named pipe already opened.
299 ****************************************************************************/
300
301 static void api_fd_reply(connection_struct *conn, uint16 vuid,
302 struct smb_request *req,
303 uint16 *setup, char *data, char *params,
304 int suwcnt, int tdscnt, int tpscnt,
305 int mdrcnt, int mprcnt)
306 {
307 bool reply = False;
308 smb_np_struct *p = NULL;
309 int pnum;
310 int subcommand;
311
312 DEBUG(5,("api_fd_reply\n"));
313
314 /* First find out the name of this file. */
315 if (suwcnt != 2) {
316 DEBUG(0,("Unexpected named pipe transaction.\n"));
317 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
318 return;
319 }
320
321 /* Get the file handle and hence the file name. */
322 /*
323 * NB. The setup array has already been transformed
324 * via SVAL and so is in host byte order.
325 */
326 pnum = ((int)setup[1]) & 0xFFFF;
327 subcommand = ((int)setup[0]) & 0xFFFF;
328
329 if(!(p = get_rpc_pipe(pnum))) {
330 if (subcommand == TRANSACT_WAITNAMEDPIPEHANDLESTATE) {
331 /* Win9x does this call with a unicode pipe name, not a pnum. */
332 /* Just return success for now... */
333 DEBUG(3,("Got TRANSACT_WAITNAMEDPIPEHANDLESTATE on text pipe name\n"));
334 send_trans_reply(conn, req->inbuf, NULL, 0, NULL, 0,
335 False);
336 return;
337 }
338
339 DEBUG(1,("api_fd_reply: INVALID PIPE HANDLE: %x\n", pnum));
340 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
341 return;
342 }
343
344 if (vuid != p->vuid) {
345 DEBUG(1, ("Got pipe request (pnum %x) using invalid VUID %d, "
346 "expected %d\n", pnum, vuid, p->vuid));
347 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
348 return;
349 }
350
351 DEBUG(3,("Got API command 0x%x on pipe \"%s\" (pnum %x)\n", subcommand, p->name, pnum));
352
353 /* record maximum data length that can be transmitted in an SMBtrans */
354 p->max_trans_reply = mdrcnt;
355
356 DEBUG(10,("api_fd_reply: p:%p max_trans_reply: %d\n", p, p->max_trans_reply));
357
358 switch (subcommand) {
359 case TRANSACT_DCERPCCMD:
360 /* dce/rpc command */
361 reply = write_to_pipe(p, data, tdscnt);
362 if (!reply) {
363 api_no_reply(conn, req);
364 return;
365 }
366 api_rpc_trans_reply(conn, req, p);
367 break;
368 case TRANSACT_WAITNAMEDPIPEHANDLESTATE:
369 /* Wait Named Pipe Handle state */
370 api_WNPHS(conn, req, p, params, tpscnt);
371 break;
372 case TRANSACT_SETNAMEDPIPEHANDLESTATE:
373 /* Set Named Pipe Handle state */
374 api_SNPHS(conn, req, p, params, tpscnt);
375 break;
376 default:
377 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
378 return;
379 }
380 }
381
382 /****************************************************************************
383 Handle named pipe commands.
384 ****************************************************************************/
385
386 static void named_pipe(connection_struct *conn, uint16 vuid,
387 struct smb_request *req,
388 const char *name, uint16 *setup,
389 char *data, char *params,
390 int suwcnt, int tdscnt,int tpscnt,
391 int msrcnt, int mdrcnt, int mprcnt)
392 {
393 DEBUG(3,("named pipe command on <%s> name\n", name));
394
395 if (strequal(name,"LANMAN")) {
396 api_reply(conn, vuid, req,
397 data, params,
398 tdscnt, tpscnt,
399 mdrcnt, mprcnt);
400 return;
401 }
402
403 if (strequal(name,"WKSSVC") ||
404 strequal(name,"SRVSVC") ||
405 strequal(name,"WINREG") ||
406 strequal(name,"SAMR") ||
407 strequal(name,"LSARPC")) {
408
409 DEBUG(4,("named pipe command from Win95 (wow!)\n"));
410
411 api_fd_reply(conn, vuid, req,
412 setup, data, params,
413 suwcnt, tdscnt, tpscnt,
414 mdrcnt, mprcnt);
415 return;
416 }
417
418 if (strlen(name) < 1) {
419 api_fd_reply(conn, vuid, req,
420 setup, data,
421 params, suwcnt, tdscnt,
422 tpscnt, mdrcnt, mprcnt);
423 return;
424 }
425
426 if (setup)
427 DEBUG(3,("unknown named pipe: setup 0x%X setup1=%d\n",
428 (int)setup[0],(int)setup[1]));
429
430 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
431 return;
432 }
433
434 static void handle_trans(connection_struct *conn, struct smb_request *req,
435 struct trans_state *state)
436 {
437 char *local_machine_name;
438 int name_offset = 0;
439
440 DEBUG(3,("trans <%s> data=%u params=%u setup=%u\n",
441 state->name,(unsigned int)state->total_data,(unsigned int)state->total_param,
442 (unsigned int)state->setup_count));
443
444 /*
445 * WinCE wierdness....
446 */
447
448 local_machine_name = talloc_asprintf(state, "\\%s\\",
449 get_local_machine_name());
450
451 if (local_machine_name == NULL) {
452 reply_nterror(req, NT_STATUS_NO_MEMORY);
453 return;
454 }
455
456 if (strnequal(state->name, local_machine_name,
457 strlen(local_machine_name))) {
458 name_offset = strlen(local_machine_name)-1;
459 }
460
461 if (!strnequal(&state->name[name_offset], "\\PIPE",
462 strlen("\\PIPE"))) {
463 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
464 return;
465 }
466
467 name_offset += strlen("\\PIPE");
468
469 /* Win9x weirdness. When talking to a unicode server Win9x
470 only sends \PIPE instead of \PIPE\ */
471
472 if (state->name[name_offset] == '\\')
473 name_offset++;
474
475 DEBUG(5,("calling named_pipe\n"));
476 named_pipe(conn, state->vuid, req,
477 state->name+name_offset,
478 state->setup,state->data,
479 state->param,
480 state->setup_count,state->total_data,
481 state->total_param,
482 state->max_setup_return,
483 state->max_data_return,
484 state->max_param_return);
485
486 if (state->close_on_completion) {
487 close_cnum(conn,state->vuid);
488 req->conn = NULL;
489 }
490
491 return;
492 }
493
494 /****************************************************************************
495 Reply to a SMBtrans.
496 ****************************************************************************/
497
498 void reply_trans(struct smb_request *req)
499 {
500 connection_struct *conn = req->conn;
501 unsigned int dsoff;
502 unsigned int dscnt;
503 unsigned int psoff;
504 unsigned int pscnt;
505 struct trans_state *state;
506 NTSTATUS result;
507 unsigned int size;
508 unsigned int av_size;
509
510 START_PROFILE(SMBtrans);
511
512 if (req->wct < 14) {
513 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
514 END_PROFILE(SMBtrans);
515 return;
516 }
517
518 size = smb_len(req->inbuf) + 4;
519 av_size = smb_len(req->inbuf);
520 dsoff = SVAL(req->inbuf, smb_dsoff);
521 dscnt = SVAL(req->inbuf, smb_dscnt);
522 psoff = SVAL(req->inbuf, smb_psoff);
523 pscnt = SVAL(req->inbuf, smb_pscnt);
524
525 result = allow_new_trans(conn->pending_trans, req->mid);
526 if (!NT_STATUS_IS_OK(result)) {
527 DEBUG(2, ("Got invalid trans request: %s\n",
528 nt_errstr(result)));
529 reply_nterror(req, result);
530 END_PROFILE(SMBtrans);
531 return;
532 }
533
534 if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
535 DEBUG(0, ("talloc failed\n"));
536 reply_nterror(req, NT_STATUS_NO_MEMORY);
537 END_PROFILE(SMBtrans);
538 return;
539 }
540
541 state->cmd = SMBtrans;
542
543 state->mid = req->mid;
544 state->vuid = req->vuid;
545 state->setup_count = CVAL(req->inbuf, smb_suwcnt);
546 state->setup = NULL;
547 state->total_param = SVAL(req->inbuf, smb_tpscnt);
548 state->param = NULL;
549 state->total_data = SVAL(req->inbuf, smb_tdscnt);
550 state->data = NULL;
551 state->max_param_return = SVAL(req->inbuf, smb_mprcnt);
552 state->max_data_return = SVAL(req->inbuf, smb_mdrcnt);
553 state->max_setup_return = CVAL(req->inbuf, smb_msrcnt);
554 state->close_on_completion = BITSETW(req->inbuf+smb_vwv5,0);
555 state->one_way = BITSETW(req->inbuf+smb_vwv5,1);
556
557 srvstr_pull_buf_talloc(state, req->inbuf, req->flags2, &state->name,
558 smb_buf(req->inbuf), STR_TERMINATE);
559
560 if ((dscnt > state->total_data) || (pscnt > state->total_param) ||
561 !state->name)
562 goto bad_param;
563
564 if (state->total_data) {
565 /* Can't use talloc here, the core routines do realloc on the
566 * params and data. Out of paranoia, 100 bytes too many. */
567 state->data = (char *)SMB_MALLOC(state->total_data+100);
568 if (state->data == NULL) {
569 DEBUG(0,("reply_trans: data malloc fail for %u "
570 "bytes !\n", (unsigned int)state->total_data));
571 TALLOC_FREE(state);
572 reply_nterror(req, NT_STATUS_NO_MEMORY);
573 END_PROFILE(SMBtrans);
574 return;
575 }
576 /* null-terminate the slack space */
577 memset(&state->data[state->total_data], 0, 100);
578
579 if (dscnt > state->total_data ||
580 dsoff+dscnt < dsoff) {
581 goto bad_param;
582 }
583
584 if (dsoff > av_size ||
585 dscnt > av_size ||
586 dsoff+dscnt > av_size) {
587 goto bad_param;
588 }
589
590 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
591 }
592
593 if (state->total_param) {
594 /* Can't use talloc here, the core routines do realloc on the
595 * params and data. Out of paranoia, 100 bytes too many */
596 state->param = (char *)SMB_MALLOC(state->total_param+100);
597 if (state->param == NULL) {
598 DEBUG(0,("reply_trans: param malloc fail for %u "
599 "bytes !\n", (unsigned int)state->total_param));
600 SAFE_FREE(state->data);
601 TALLOC_FREE(state);
602 reply_nterror(req, NT_STATUS_NO_MEMORY);
603 END_PROFILE(SMBtrans);
604 return;
605 }
606 /* null-terminate the slack space */
607 memset(&state->param[state->total_param], 0, 100);
608
609 if (pscnt > state->total_param ||
610 psoff+pscnt < psoff) {
611 goto bad_param;
612 }
613
614 if (psoff > av_size ||
615 pscnt > av_size ||
616 psoff+pscnt > av_size) {
617 goto bad_param;
618 }
619
620 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
621 }
622
623 state->received_data = dscnt;
624 state->received_param = pscnt;
625
626 if (state->setup_count) {
627 unsigned int i;
628 if((state->setup = TALLOC_ARRAY(
629 state, uint16, state->setup_count)) == NULL) {
630 DEBUG(0,("reply_trans: setup malloc fail for %u "
631 "bytes !\n", (unsigned int)
632 (state->setup_count * sizeof(uint16))));
633 SAFE_FREE(state->data);
634 SAFE_FREE(state->param);
635 TALLOC_FREE(state);
636 reply_nterror(req, NT_STATUS_NO_MEMORY);
637 END_PROFILE(SMBtrans);
638 return;
639 }
640 if (req->inbuf+smb_vwv14+(state->setup_count*SIZEOFWORD) >
641 req->inbuf + size)
642 goto bad_param;
643 if ((smb_vwv14+(state->setup_count*SIZEOFWORD) < smb_vwv14) ||
644 (smb_vwv14+(state->setup_count*SIZEOFWORD) <
645 (state->setup_count*SIZEOFWORD)))
646 goto bad_param;
647
648 for (i=0;i<state->setup_count;i++)
649 state->setup[i] = SVAL(req->inbuf,
650 smb_vwv14+i*SIZEOFWORD);
651 }
652
653 state->received_param = pscnt;
654
655 if ((state->received_param != state->total_param) ||
656 (state->received_data != state->total_data)) {
657 DLIST_ADD(conn->pending_trans, state);
658
659 /* We need to send an interim response then receive the rest
660 of the parameter/data bytes */
661 reply_outbuf(req, 0, 0);
662 show_msg((char *)req->outbuf);
663 END_PROFILE(SMBtrans);
664 return;
665 }
666
667 talloc_steal(talloc_tos(), state);
668
669 handle_trans(conn, req, state);
670
671 SAFE_FREE(state->data);
672 SAFE_FREE(state->param);
673 TALLOC_FREE(state);
674
675 END_PROFILE(SMBtrans);
676 return;
677
678 bad_param:
679
680 DEBUG(0,("reply_trans: invalid trans parameters\n"));
681 SAFE_FREE(state->data);
682 SAFE_FREE(state->param);
683 TALLOC_FREE(state);
684 END_PROFILE(SMBtrans);
685 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
686 return;
687 }
688
689 /****************************************************************************
690 Reply to a secondary SMBtrans.
691 ****************************************************************************/
692
693 void reply_transs(struct smb_request *req)
694 {
695 connection_struct *conn = req->conn;
696 unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
697 struct trans_state *state;
698 unsigned int av_size;
699
700 START_PROFILE(SMBtranss);
701
702 show_msg((char *)req->inbuf);
703
704 if (req->wct < 8) {
705 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
706 END_PROFILE(SMBtranss);
707 return;
708 }
709
710 for (state = conn->pending_trans; state != NULL;
711 state = state->next) {
712 if (state->mid == req->mid) {
713 break;
714 }
715 }
716
717 if ((state == NULL) || (state->cmd != SMBtrans)) {
718 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
719 END_PROFILE(SMBtranss);
720 return;
721 }
722
723 /* Revise total_params and total_data in case they have changed
724 * downwards */
725
726 if (SVAL(req->inbuf, smb_vwv0) < state->total_param)
727 state->total_param = SVAL(req->inbuf,smb_vwv0);
728 if (SVAL(req->inbuf, smb_vwv1) < state->total_data)
729 state->total_data = SVAL(req->inbuf,smb_vwv1);
730
731 av_size = smb_len(req->inbuf);
732
733 pcnt = SVAL(req->inbuf, smb_spscnt);
734 poff = SVAL(req->inbuf, smb_spsoff);
735 pdisp = SVAL(req->inbuf, smb_spsdisp);
736
737 dcnt = SVAL(req->inbuf, smb_sdscnt);
738 doff = SVAL(req->inbuf, smb_sdsoff);
739 ddisp = SVAL(req->inbuf, smb_sdsdisp);
740
741 state->received_param += pcnt;
742 state->received_data += dcnt;
743
744 if ((state->received_data > state->total_data) ||
745 (state->received_param > state->total_param))
746 goto bad_param;
747
748 if (pcnt) {
749 if (pdisp > state->total_param ||
750 pcnt > state->total_param ||
751 pdisp+pcnt > state->total_param ||
752 pdisp+pcnt < pdisp) {
753 goto bad_param;
754 }
755
756 if (poff > av_size ||
757 pcnt > av_size ||
758 poff+pcnt > av_size ||
759 poff+pcnt < poff) {
760 goto bad_param;
761 }
762
763 memcpy(state->param+pdisp,smb_base(req->inbuf)+poff,
764 pcnt);
765 }
766
767 if (dcnt) {
768 if (ddisp > state->total_data ||
769 dcnt > state->total_data ||
770 ddisp+dcnt > state->total_data ||
771 ddisp+dcnt < ddisp) {
772 goto bad_param;
773 }
774
775 if (doff > av_size ||
776 dcnt > av_size ||
777 doff+dcnt > av_size ||
778 doff+dcnt < doff) {
779 goto bad_param;
780 }
781
782 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
783 dcnt);
784 }
785
786 if ((state->received_param < state->total_param) ||
787 (state->received_data < state->total_data)) {
788 END_PROFILE(SMBtranss);
789 return;
790 }
791
792 /*
793 * construct_reply_common will copy smb_com from inbuf to
794 * outbuf. SMBtranss is wrong here.
795 */
796 SCVAL(req->inbuf,smb_com,SMBtrans);
797
798 talloc_steal(talloc_tos(), state);
799
800 handle_trans(conn, req, state);
801
802 DLIST_REMOVE(conn->pending_trans, state);
803 SAFE_FREE(state->data);
804 SAFE_FREE(state->param);
805 TALLOC_FREE(state);
806
807 END_PROFILE(SMBtranss);
808 return;
809
810 bad_param:
811
812 DEBUG(0,("reply_transs: invalid trans parameters\n"));
813 DLIST_REMOVE(conn->pending_trans, state);
814 SAFE_FREE(state->data);
815 SAFE_FREE(state->param);
816 TALLOC_FREE(state);
817 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
818 END_PROFILE(SMBtranss);
819 return;
820 }
Samba GIT mirror