s4-torture: remove unchecked read from smb2 create
[Samba/wip.git] / source3 / libsmb / smb2cli_read.c
blob75754fe6b1dc9dfa4bd9839f2d32e807c6db685b
1 /*
2 Unix SMB/CIFS implementation.
3 smb2 lib
4 Copyright (C) Volker Lendecke 2011
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 #include "includes.h"
21 #include "client.h"
22 #include "async_smb.h"
23 #include "smb2cli_base.h"
24 #include "smb2cli.h"
25 #include "libsmb/proto.h"
26 #include "lib/util/tevent_ntstatus.h"
28 struct smb2cli_read_state {
29 uint8_t fixed[48];
30 uint8_t dyn_pad[1];
31 struct iovec *recv_iov;
32 uint8_t *data;
33 uint32_t data_length;
36 static void smb2cli_read_done(struct tevent_req *subreq);
38 struct tevent_req *smb2cli_read_send(TALLOC_CTX *mem_ctx,
39 struct tevent_context *ev,
40 struct cli_state *cli,
41 uint32_t length,
42 uint64_t offset,
43 uint64_t fid_persistent,
44 uint64_t fid_volatile,
45 uint64_t minimum_count,
46 uint64_t remaining_bytes)
48 struct tevent_req *req, *subreq;
49 struct smb2cli_read_state *state;
50 uint8_t *fixed;
52 req = tevent_req_create(mem_ctx, &state,
53 struct smb2cli_read_state);
54 if (req == NULL) {
55 return NULL;
58 fixed = state->fixed;
60 SSVAL(fixed, 0, 49);
61 SIVAL(fixed, 4, length);
62 SBVAL(fixed, 8, offset);
63 SBVAL(fixed, 16, fid_persistent);
64 SBVAL(fixed, 24, fid_volatile);
65 SBVAL(fixed, 32, minimum_count);
66 SBVAL(fixed, 40, remaining_bytes);
68 subreq = smb2cli_req_send(state, ev, cli, SMB2_OP_READ,
69 0, 0, /* flags */
70 cli->timeout,
71 cli->smb2.pid,
72 cli->smb2.tid,
73 cli->smb2.uid,
74 state->fixed, sizeof(state->fixed),
75 state->dyn_pad, sizeof(state->dyn_pad));
76 if (tevent_req_nomem(subreq, req)) {
77 return tevent_req_post(req, ev);
79 tevent_req_set_callback(subreq, smb2cli_read_done, req);
80 return req;
83 static void smb2cli_read_done(struct tevent_req *subreq)
85 struct tevent_req *req = tevent_req_callback_data(
86 subreq, struct tevent_req);
87 struct smb2cli_read_state *state =
88 tevent_req_data(req,
89 struct smb2cli_read_state);
90 NTSTATUS status;
91 struct iovec *iov;
92 uint8_t data_offset;
93 static const struct smb2cli_req_expected_response expected[] = {
95 .status = STATUS_BUFFER_OVERFLOW,
96 .body_size = 0x11
99 .status = NT_STATUS_OK,
100 .body_size = 0x11
104 status = smb2cli_req_recv(subreq, state, &iov,
105 expected, ARRAY_SIZE(expected));
106 if (tevent_req_nterror(req, status)) {
107 return;
110 data_offset = CVAL(iov[1].iov_base, 2);
111 state->data_length = IVAL(iov[1].iov_base, 4);
113 if ((data_offset != SMB2_HDR_BODY + 16) ||
114 (state->data_length > iov[2].iov_len)) {
115 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
116 return;
119 state->recv_iov = iov;
120 state->data = (uint8_t *)iov[2].iov_base;
121 tevent_req_done(req);
124 NTSTATUS smb2cli_read_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
125 uint8_t **data, uint32_t *data_length)
127 struct smb2cli_read_state *state =
128 tevent_req_data(req,
129 struct smb2cli_read_state);
130 NTSTATUS status;
132 if (tevent_req_is_nterror(req, &status)) {
133 return status;
135 talloc_steal(mem_ctx, state->recv_iov);
136 *data_length = state->data_length;
137 *data = state->data;
138 return NT_STATUS_OK;
141 NTSTATUS smb2cli_read(struct cli_state *cli,
142 uint32_t length,
143 uint64_t offset,
144 uint64_t fid_persistent,
145 uint64_t fid_volatile,
146 uint64_t minimum_count,
147 uint64_t remaining_bytes,
148 TALLOC_CTX *mem_ctx,
149 uint8_t **data,
150 uint32_t *data_length)
152 TALLOC_CTX *frame = talloc_stackframe();
153 struct event_context *ev;
154 struct tevent_req *req;
155 NTSTATUS status = NT_STATUS_NO_MEMORY;
157 if (cli_has_async_calls(cli)) {
159 * Can't use sync call while an async call is in flight
161 status = NT_STATUS_INVALID_PARAMETER;
162 goto fail;
164 ev = event_context_init(frame);
165 if (ev == NULL) {
166 goto fail;
168 req = smb2cli_read_send(frame, ev, cli, length, offset,
169 fid_persistent, fid_volatile,
170 minimum_count, remaining_bytes);
171 if (req == NULL) {
172 goto fail;
174 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
175 goto fail;
177 status = smb2cli_read_recv(req, mem_ctx, data, data_length);
178 fail:
179 TALLOC_FREE(frame);
180 return status;