Changeset 444 for branches/client-1.6/src/smbwrp.c

Timestamp:

Apr 22, 2010, 6:20:08 PM (15 years ago)

Author:

Silvan Scherrer

Message:

samba client 1.6: more work

File:

• branches/client-1.6/src/smbwrp.c (modified) (18 diffs)

branches/client-1.6/src/smbwrp.c

@@ -21 +21 @@
 #include "includes.h"
 #include "smbwrp.h"
+/****************************************************************************
+ Calculate a safe next_entry_offset.
+****************************************************************************/
+
+static size_t calc_next_entry_offset(const char *base, const char *pdata_end)
+{
+        size_t next_entry_offset = (size_t)IVAL(base,0);
+
+        if (next_entry_offset == 0 ||
+                        base + next_entry_offset < base ||
+                        base + next_entry_offset > pdata_end) {
+                next_entry_offset = pdata_end - base;
+        }
+        return next_entry_offset;
+}
 
 void smbwrp_Logging()
@@ -1069 +1084 @@
 // in the longrun we should switch to file_info struct instead of our own smbwrp_fileinfo
 
-static size_t _os2_interpret_long_filename(struct cli_state *cli,
-                                   int level,char *p, smbwrp_fileinfo *finfo,
-                                        uint32 *p_resume_key, DATA_BLOB *p_last_name_raw, uint32 *p_last_name_raw_len)
+static size_t _os2_interpret_long_filename(TALLOC_CTX *ctx, struct cli_state *cli,
+                                   int level,const char *p, const char *pdata_end, smbwrp_fileinfo *finfo,
+                                        uint32 *p_resume_key, DATA_BLOB *p_last_name_raw)
 {
         int len;
-        char *base = p;
-        smbwrp_fileinfo finfo1;
+        const char *base = p;
+        size_t ret;
         
-        if (!finfo) finfo = &finfo1;
+        data_blob_free(p_last_name_raw);
 
         if (p_resume_key) {
@@ -1083 +1098 @@
         }
 
-        ZERO_STRUCT(finfo);
+//      ZERO_STRUCTP(finfo);
         debuglocal(9,"fname %s (serverzone %d, level %d)\n",finfo->fname, cli->serverzone, level);
         
@@ -1090 +1105 @@
                         /* these dates are converted to GMT by
                            make_unix_date */
+                        if (pdata_end - base < 27) {
+                                return pdata_end - base;
+                        }
                         finfo->ctime = cli_make_unix_date2(cli, p+4) - cli->serverzone;
                         finfo->atime = cli_make_unix_date2(cli, p+8) - cli->serverzone;
@@ -1098 +1116 @@
                         p += 27;
                         p += clistr_align_in(cli, p, 0);
+
+                        /* We can safely use len here (which is required by OS/2)
+                         * and the NAS-BASIC server instead of +2 or +1 as the
+                         * STR_TERMINATE flag below is
+                         * actually used as the length calculation.
+                         * The len is merely an upper bound.
+                         * Due to the explicit 2 byte null termination
+                         * in cli_receive_trans/cli_receive_nt_trans
+                         * we know this is safe. JRA + kukks
+                         */
+
+                        if (p + len > pdata_end) {
+                                return pdata_end - base;
+                        }
+
                         /* the len+2 below looks strange but it is
                            important to cope with the differences
                            between win2000 and win9x for this call
                            (tridge) */
-                        p += clistr_pull(cli, finfo->fname, p,
-                                         sizeof(finfo->fname),
+                        ret = clistr_pull_talloc(ctx, cli, &finfo->fname, p,
                                          len+2,
                                          STR_TERMINATE);
+                        if (ret == (size_t)-1) {
+                                return pdata_end - base;
+                        }
+                        p += ret;
                         finfo->easize = -1;
                         return PTR_DIFF(p, base);
@@ -1112 +1148 @@
                         /* these dates are converted to GMT by
                            make_unix_date */
+                        if (pdata_end - base < 31) {
+                                return pdata_end - base;
+                        }
                         finfo->ctime = cli_make_unix_date2(cli, p+4) - cli->serverzone;
                         finfo->atime = cli_make_unix_date2(cli, p+8) - cli->serverzone;
@@ -1121 +1160 @@
                         p += 31;
                         /* check for unisys! */
-                        p += clistr_pull(cli, finfo->fname, p,
-                                         sizeof(finfo->fname),
+                        if (p + len + 1 > pdata_end) {
+                                return pdata_end - base;
+                        }
+                        ret = clistr_pull_talloc(ctx, cli, &finfo->fname, p,
                                          len, 
                                          STR_NOALIGN);
+                        if (ret == (size_t)-1) {
+                                return pdata_end - base;
+                        }
+                        p += ret;
                         return PTR_DIFF(p, base) + 1;
                         
@@ -1130 +1175 @@
                 {
                         size_t namelen, slen;
+
+                        if (pdata_end - base < 94) {
+                                return pdata_end - base;
+                        }
+
                         p += 4; /* next entry offset */
+
                         if (p_resume_key) {
                                 *p_resume_key = IVAL(p,0);
@@ -1155 +1206 @@
                         p += 4; /* EA size */
                         slen = SVAL(p, 0);
+                        if (slen > 24) {
+                                /* Bad short name length. */
+                                return pdata_end - base;
+                        }
                         p += 2; 
 #if 0                   
@@ -1166 +1221 @@
                         }
 #endif
-                        p += 24; /* short name? */        
-                        clistr_pull(cli, finfo->fname, p,
-                                    sizeof(finfo->fname),
+                        p += 24; /* short name? */
+                        if (p + namelen < p || p + namelen > pdata_end) {
+                                return pdata_end - base;
+                        }         
+                        ret = clistr_pull_talloc(ctx, cli, &finfo->fname, p,
                                     namelen, 0);
+                        if (ret == (size_t)-1) {
+                                return pdata_end - base;
+                        }
 
                         /* To be robust in the face of unicode conversion failures
@@ -1176 +1236 @@
                            copy it here. */
 #if 0
-                        if (p_last_name_raw && p_last_name_raw_len) {
-                                if (namelen + 2 > p_last_name_raw->length) {
-                                        memset(p_last_name_raw->data, '\0', sizeof(p_last_name_raw->length));
-                                        *p_last_name_raw_len = 0;
-                                } else {
-                                        memcpy(p_last_name_raw->data, p, namelen);
-                                        SSVAL(p_last_name_raw->data, namelen, 0);
-                                        *p_last_name_raw_len = namelen + 2;
-                                }
+                        if (p_last_name_raw) {
+                                *p_last_name_raw = data_blob(NULL, namelen+2);
+                                memcpy(p_last_name_raw->data, p, namelen);
+                                SSVAL(p_last_name_raw->data, namelen, 0);
                         }
 #endif
-                        return (size_t)IVAL(base, 0);
+                        return calc_next_entry_offset(base, pdata_end);
                 }
         }
         
         debuglocal(1,"Unknown long filename format %d\n",level);
-        return (size_t)IVAL(base,0);
+        return calc_next_entry_offset(base, pdata_end);
 }
 
@@ -1227 +1282 @@
         const char *mnt;
         uint32 resume_key = 0;
-        uint32 last_name_raw_len = 0;
+        TALLOC_CTX *frame = talloc_stackframe();
         DATA_BLOB last_name_raw = data_blob(NULL, 0);
 
@@ -1234 +1289 @@
         
         debuglocal(4,"list_files level %d. mask <%s>\n", info_level, Mask);
-
-        /* when getting a directory listing from a 2k dfs root share, 
-           we have to include the full path (\server\share\mask) here */
-           
-        if ( cli->dfsroot ) {
-                mask = talloc_asprintf(mask, "\\%s\\%s\\%s", cli->desthost, cli->share, Mask );
-        } else {
-                mask = SMB_STRDUP(Mask);
-                if (!mask) {
-                      return -1;
-                }
+   
+        mask = SMB_STRDUP(Mask);
+        if (!mask) {
+                TALLOC_FREE(frame);
+                return -1;
         }
 
         while (ff_eos == 0) {
+                size_t nlen = 2*(strlen(mask)+1);
+
                 loop_count++;
                 if (loop_count > 200) {
@@ -1254 +1305 @@
                 }
 
-                size_t nlen = 2*(strlen(mask)+1);
                 param = SMB_MALLOC_ARRAY(char, 12+nlen+last_name_raw.length+2);
                 if (!param) {
@@ -1306 +1356 @@
                                     )) {
                         SAFE_FREE(param);
+                        TALLOC_FREE(frame);
                         break;
                 }
@@ -1391 +1442 @@
                                 SIVAL(p2,0,PTR_DIFF((rdata + data_len),p2));
                         }
-                        p2 += _os2_interpret_long_filename(cli,info_level,p2,&finfo,
-                                                        &resume_key,&last_name_raw,&last_name_raw.length);
+                        p2 += _os2_interpret_long_filename(frame, cli, info_level, p2, rdata_end, &finfo,
+                                                        &resume_key, &last_name_raw);
 
                         if (!finfo.fname) {
@@ -1456 +1507 @@
         } else {
                 /* no connection problem.  let user function add each entry */
+                rdata_end = dirlist + dirlist_len;
                 for (p=dirlist,i=0;i<total_received;i++) {
-                        p += _os2_interpret_long_filename(cli, info_level, p,
-                                                     &finfo,NULL,NULL,NULL);
+                        p += _os2_interpret_long_filename(frame, cli, info_level, p, rdata_end,
+                                                     &finfo,NULL,NULL);
+                        if (!finfo.fname) {
+                                debuglocal(0,"list_new: unable to parse name from info level %d\n",
+                                        info_level);
+                                break;
+                        }
                         fn( mnt,&finfo, Mask, state );
                 }
@@ -1465 +1522 @@
         /* free up the dirlist buffer and last name raw blob */
         SAFE_FREE(dirlist);
+        data_blob_free(&last_name_raw);
         SAFE_FREE(mask);
-        data_blob_free(&last_name_raw);
+        TALLOC_FREE(frame);
         return(total_received);
 }