Changeset 745 for trunk/server/source3/smbd/smb2_find.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/smbd/smb2_find.c (modified) (11 diffs)

trunk/server/source3/smbd/smb2_find.c

@@ -20 +20 @@
 
 #include "includes.h"
+#include "smbd/smbd.h"
 #include "smbd/globals.h"
 #include "../libcli/smb/smb_common.h"
+#include "trans2.h"
+#include "../lib/util/tevent_ntstatus.h"
 
 static struct tevent_req *smbd_smb2_find_send(TALLOC_CTX *mem_ctx,
@@ -90 +93 @@
         }
 
+        /* The output header is 8 bytes. */
+        if (in_output_buffer_length <= 8) {
+                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+        }
+
+        DEBUG(10,("smbd_smb2_request_find_done: in_output_buffer_length = %u\n",
+                (unsigned int)in_output_buffer_length ));
+
+        /* Take into account the output header. */
+        in_output_buffer_length -= 8;
+
         in_file_name_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
         in_file_name_buffer.length = in_file_name_length;
@@ -104 +118 @@
         if (req->compat_chain_fsp) {
                 /* skip check */
-        } else if (in_file_id_persistent != 0) {
+        } else if (in_file_id_persistent != in_file_id_volatile) {
                 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
         }
@@ -172 +186 @@
         SIVAL(outbody.data, 0x04,
               out_output_buffer.length);        /* output buffer length */
+
+        DEBUG(10,("smbd_smb2_request_find_done: out_output_buffer.length = %u\n",
+                (unsigned int)out_output_buffer.length ));
 
         outdyn = out_output_buffer;
@@ -211 +228 @@
         char *end_data;
         int last_entry_off = 0;
-        uint64_t off = 0;
+        int off = 0;
         uint32_t num = 0;
-        uint32_t dirtype = aHIDDEN | aSYSTEM | aDIR;
-        const char *directory;
+        uint32_t dirtype = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_DIRECTORY;
         bool dont_descend = false;
         bool ask_sharemode = true;
@@ -253 +269 @@
         }
 
-        directory = fsp->fsp_name->base_name;
-
         if (strcmp(in_file_name, "") == 0) {
                 tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_INVALID);
@@ -304 +318 @@
 
         if (in_flags & SMB2_CONTINUE_FLAG_REOPEN) {
-                if (fsp->dptr) {
-                        dptr_CloseDir(fsp->dptr);
-                        fsp->dptr = NULL;
-                }
+                dptr_CloseDir(fsp);
         }
 
@@ -321 +332 @@
 
                 status = dptr_create(conn,
-                                     directory,
+                                     fsp,
+                                     fsp->fsp_name->base_name,
                                      false, /* old_handle */
                                      false, /* expect_close */
@@ -360 +372 @@
         pdata = (char *)state->out_output_buffer.data;
         base_data = pdata;
-        end_data = pdata + in_output_buffer_length;
+        /*
+         * end_data must include the safety margin as it's what is
+         * used to determine if pushed strings have been truncated.
+         */
+        end_data = pdata + in_output_buffer_length + DIR_ENTRY_SAFETY_MARGIN - 1;
         last_entry_off = 0;
         off = 0;
         num = 0;
 
-        DEBUG(8,("smbd_smb2_find_send: dirpath=<%s> dontdescend=<%s>\n",
-                directory, lp_dontdescend(SNUM(conn))));
-        if (in_list(directory,lp_dontdescend(SNUM(conn)),conn->case_sensitive)) {
+        DEBUG(8,("smbd_smb2_find_send: dirpath=<%s> dontdescend=<%s>, "
+                "in_output_buffer_length = %u\n",
+                fsp->fsp_name->base_name, lp_dontdescend(SNUM(conn)),
+                (unsigned int)in_output_buffer_length ));
+        if (in_list(fsp->fsp_name->base_name,lp_dontdescend(SNUM(conn)),
+                        conn->case_sensitive)) {
                 dont_descend = true;
         }
@@ -380 +399 @@
                 bool out_of_space = false;
                 int space_remaining = in_output_buffer_length - off;
+
+                SMB_ASSERT(space_remaining >= 0);
 
                 ok = smbd_dirptr_lanman2_entry(state,
@@ -402 +423 @@
                                                NULL);
 
-                off = PTR_DIFF(pdata, base_data);
+                off = (int)PTR_DIFF(pdata, base_data);
 
                 if (!ok) {