This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
Send a trans reply.
****************************************************************************/
-void send_trans_reply(char *outbuf,
- char *rparam, int rparam_len,
- char *rdata, int rdata_len,
- BOOL buffer_too_large)
+void send_trans_reply(const char *inbuf,
+ char *outbuf,
+ char *rparam,
+ int rparam_len,
+ char *rdata,
+ int rdata_len,
+ BOOL buffer_too_large)
{
int this_ldata,this_lparam;
int tot_data_sent = 0;
ERROR_BOTH(STATUS_BUFFER_OVERFLOW,ERRDOS,ERRmoredata);
}
- set_message(outbuf,10,1+align+this_ldata+this_lparam,True);
+ set_message(inbuf,outbuf,10,1+align+this_ldata+this_lparam,True);
copy_trans_params_and_data(outbuf, align,
- rparam, tot_param_sent, this_lparam,
- rdata, tot_data_sent, this_ldata);
+ rparam, tot_param_sent, this_lparam,
+ rdata, tot_data_sent, this_ldata);
SSVAL(outbuf,smb_vwv0,lparam);
SSVAL(outbuf,smb_vwv1,ldata);
show_msg(outbuf);
if (!send_smb(smbd_server_fd(),outbuf))
- exit_server("send_trans_reply: send_smb failed.");
+ exit_server_cleanly("send_trans_reply: send_smb failed.");
tot_data_sent = this_ldata;
tot_param_sent = this_lparam;
align = (this_lparam%4);
- set_message(outbuf,10,1+this_ldata+this_lparam+align,False);
+ set_message(inbuf,outbuf,10,1+this_ldata+this_lparam+align,False);
copy_trans_params_and_data(outbuf, align,
rparam, tot_param_sent, this_lparam,
show_msg(outbuf);
if (!send_smb(smbd_server_fd(),outbuf))
- exit_server("send_trans_reply: send_smb failed.");
+ exit_server_cleanly("send_trans_reply: send_smb failed.");
tot_data_sent += this_ldata;
tot_param_sent += this_lparam;
Start the first part of an RPC reply which began with an SMBtrans request.
****************************************************************************/
-static BOOL api_rpc_trans_reply(char *outbuf, smb_np_struct *p)
+static BOOL api_rpc_trans_reply(const char *inbuf,
+ char *outbuf,
+ smb_np_struct *p)
{
BOOL is_data_outstanding;
char *rdata = (char *)SMB_MALLOC(p->max_trans_reply);
return False;
}
- send_trans_reply(outbuf, NULL, 0, rdata, data_len, is_data_outstanding);
+ send_trans_reply(inbuf, outbuf, NULL, 0, rdata, data_len, is_data_outstanding);
SAFE_FREE(rdata);
return True;
WaitNamedPipeHandleState
****************************************************************************/
-static BOOL api_WNPHS(char *outbuf, smb_np_struct *p, char *param, int param_len)
+static BOOL api_WNPHS(const char *inbuf,
+ char *outbuf,
+ smb_np_struct *p,
+ char *param,
+ int param_len)
{
uint16 priority;
if (wait_rpc_pipe_hnd_state(p, priority)) {
/* now send the reply */
- send_trans_reply(outbuf, NULL, 0, NULL, 0, False);
+ send_trans_reply(inbuf, outbuf, NULL, 0, NULL, 0, False);
return True;
}
return False;
SetNamedPipeHandleState
****************************************************************************/
-static BOOL api_SNPHS(char *outbuf, smb_np_struct *p, char *param, int param_len)
+static BOOL api_SNPHS(const char *inbuf,
+ char *outbuf,
+ smb_np_struct *p,
+ char *param,
+ int param_len)
{
uint16 id;
if (set_rpc_pipe_hnd_state(p, id)) {
/* now send the reply */
- send_trans_reply(outbuf, NULL, 0, NULL, 0, False);
+ send_trans_reply(inbuf, outbuf, NULL, 0, NULL, 0, False);
return True;
}
return False;
When no reply is generated, indicate unsupported.
****************************************************************************/
-static BOOL api_no_reply(char *outbuf, int max_rdata_len)
+static BOOL api_no_reply(const char *inbuf, char *outbuf, int max_rdata_len)
{
char rparam[4];
DEBUG(3,("Unsupported API fd command\n"));
/* now send the reply */
- send_trans_reply(outbuf, rparam, 4, NULL, 0, False);
+ send_trans_reply(inbuf, outbuf, rparam, 4, NULL, 0, False);
return -1;
}
Handle remote api calls delivered to a named pipe already opened.
****************************************************************************/
-static int api_fd_reply(connection_struct *conn,uint16 vuid,char *outbuf,
- uint16 *setup,char *data,char *params,
- int suwcnt,int tdscnt,int tpscnt,int mdrcnt,int mprcnt)
+static int api_fd_reply(connection_struct *conn,
+ uint16 vuid,
+ const char *inbuf,
+ char *outbuf,
+ uint16 *setup,
+ char *data,
+ char *params,
+ int suwcnt,
+ int tdscnt,
+ int tpscnt,
+ int mdrcnt,
+ int mprcnt)
{
BOOL reply = False;
smb_np_struct *p = NULL;
/* Win9x does this call with a unicode pipe name, not a pnum. */
/* Just return success for now... */
DEBUG(3,("Got TRANSACT_WAITNAMEDPIPEHANDLESTATE on text pipe name\n"));
- send_trans_reply(outbuf, NULL, 0, NULL, 0, False);
+ send_trans_reply(inbuf, outbuf, NULL, 0, NULL, 0, False);
return -1;
}
/* dce/rpc command */
reply = write_to_pipe(p, data, tdscnt);
if (reply)
- reply = api_rpc_trans_reply(outbuf, p);
+ reply = api_rpc_trans_reply(inbuf, outbuf, p);
break;
case TRANSACT_WAITNAMEDPIPEHANDLESTATE:
/* Wait Named Pipe Handle state */
- reply = api_WNPHS(outbuf, p, params, tpscnt);
+ reply = api_WNPHS(inbuf, outbuf, p, params, tpscnt);
break;
case TRANSACT_SETNAMEDPIPEHANDLESTATE:
/* Set Named Pipe Handle state */
- reply = api_SNPHS(outbuf, p, params, tpscnt);
+ reply = api_SNPHS(inbuf, outbuf, p, params, tpscnt);
break;
default:
return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
}
if (!reply)
- return api_no_reply(outbuf, mdrcnt);
+ return api_no_reply(inbuf, outbuf, mdrcnt);
return -1;
}
/****************************************************************************
- handle named pipe commands
- ****************************************************************************/
-static int named_pipe(connection_struct *conn,uint16 vuid, char *outbuf,char *name,
- uint16 *setup,char *data,char *params,
- int suwcnt,int tdscnt,int tpscnt,
- int msrcnt,int mdrcnt,int mprcnt)
+ Handle named pipe commands.
+****************************************************************************/
+
+static int named_pipe(connection_struct *conn,
+ uint16 vuid,
+ const char *inbuf,
+ char *outbuf,
+ char *name,
+ uint16 *setup,
+ char *data,
+ char *params,
+ int suwcnt,
+ int tdscnt,
+ int tpscnt,
+ int msrcnt,
+ int mdrcnt,
+ int mprcnt)
{
DEBUG(3,("named pipe command on <%s> name\n", name));
- if (strequal(name,"LANMAN"))
- return api_reply(conn,vuid,outbuf,data,params,tdscnt,tpscnt,mdrcnt,mprcnt);
+ if (strequal(name,"LANMAN")) {
+ return api_reply(conn,
+ vuid,
+ inbuf,
+ outbuf,
+ data,
+ params,
+ tdscnt,
+ tpscnt,
+ mdrcnt,
+ mprcnt);
+ }
if (strequal(name,"WKSSVC") ||
strequal(name,"SRVSVC") ||
strequal(name,"WINREG") ||
strequal(name,"SAMR") ||
- strequal(name,"LSARPC"))
- {
+ strequal(name,"LSARPC")) {
DEBUG(4,("named pipe command from Win95 (wow!)\n"));
- return api_fd_reply(conn,vuid,outbuf,setup,data,params,suwcnt,tdscnt,tpscnt,mdrcnt,mprcnt);
+ return api_fd_reply(conn,
+ vuid,
+ inbuf,
+ outbuf,
+ setup,
+ data,
+ params,
+ suwcnt,
+ tdscnt,
+ tpscnt,
+ mdrcnt,
+ mprcnt);
}
- if (strlen(name) < 1)
- return api_fd_reply(conn,vuid,outbuf,setup,data,params,suwcnt,tdscnt,tpscnt,mdrcnt,mprcnt);
+ if (strlen(name) < 1) {
+ return api_fd_reply(conn,
+ vuid,
+ inbuf,
+ outbuf,
+ setup,
+ data,
+ params,
+ suwcnt,
+ tdscnt,
+ tpscnt,
+ mdrcnt,
+ mprcnt);
+ }
if (setup)
DEBUG(3,("unknown named pipe: setup 0x%X setup1=%d\n", (int)setup[0],(int)setup[1]));
}
static NTSTATUS handle_trans(connection_struct *conn,
- struct trans_state *state,
- char *outbuf, int *outsize)
+ struct trans_state *state,
+ const char *inbuf,
+ char *outbuf,
+ int *outsize)
{
char *local_machine_name;
int name_offset = 0;
name_offset++;
DEBUG(5,("calling named_pipe\n"));
- *outsize = named_pipe(conn, state->vuid, outbuf,
- state->name+name_offset,
- state->setup,state->data,
- state->param,
- state->setup_count,state->total_data,
- state->total_param,
- state->max_setup_return,
- state->max_data_return,
- state->max_param_return);
+ *outsize = named_pipe(conn,
+ state->vuid,
+ inbuf,
+ outbuf,
+ state->name+name_offset,
+ state->setup,state->data,
+ state->param,
+ state->setup_count,state->total_data,
+ state->total_param,
+ state->max_setup_return,
+ state->max_data_return,
+ state->max_param_return);
if (*outsize == 0) {
return NT_STATUS_NOT_SUPPORTED;
Reply to a SMBtrans.
****************************************************************************/
-int reply_trans(connection_struct *conn, char *inbuf,char *outbuf,
- int size, int bufsize)
+int reply_trans(connection_struct *conn,
+ char *inbuf,
+ char *outbuf,
+ int size,
+ int bufsize)
{
int outsize = 0;
unsigned int dsoff = SVAL(inbuf, smb_dsoff);
return ERROR_NT(result);
}
- if ((state = TALLOC_P(NULL, struct trans_state)) == NULL) {
+ if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
DEBUG(0, ("talloc failed\n"));
END_PROFILE(SMBtrans);
return ERROR_NT(NT_STATUS_NO_MEMORY);
state->mid = SVAL(inbuf, smb_mid);
state->vuid = SVAL(inbuf, smb_uid);
state->setup_count = CVAL(inbuf, smb_suwcnt);
+ state->setup = NULL;
state->total_param = SVAL(inbuf, smb_tpscnt);
state->param = NULL;
state->total_data = SVAL(inbuf, smb_tdscnt);
state->one_way = BITSETW(inbuf+smb_vwv5,1);
memset(state->name, '\0',sizeof(state->name));
- srvstr_pull_buf(inbuf, state->name, smb_buf(inbuf),
- sizeof(state->name), STR_TERMINATE);
+ srvstr_pull_buf(inbuf, SVAL(inbuf, smb_flg2), state->name,
+ smb_buf(inbuf), sizeof(state->name), STR_TERMINATE);
if ((dscnt > state->total_data) || (pscnt > state->total_param))
goto bad_param;
if (state->total_data) {
/* Can't use talloc here, the core routines do realloc on the
- * params and data. */
- state->data = (char *)SMB_MALLOC(state->total_data);
+ * params and data. Out of paranoia, 100 bytes too many. */
+ state->data = (char *)SMB_MALLOC(state->total_data+100);
if (state->data == NULL) {
DEBUG(0,("reply_trans: data malloc fail for %u "
"bytes !\n", (unsigned int)state->total_data));
END_PROFILE(SMBtrans);
return(ERROR_DOS(ERRDOS,ERRnomem));
}
+ /* null-terminate the slack space */
+ memset(&state->data[state->total_data], 0, 100);
if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
goto bad_param;
if ((smb_base(inbuf)+dsoff+dscnt > inbuf + size) ||
if (state->total_param) {
/* Can't use talloc here, the core routines do realloc on the
- * params and data. */
- state->param = (char *)SMB_MALLOC(state->total_param);
+ * params and data. Out of paranoia, 100 bytes too many */
+ state->param = (char *)SMB_MALLOC(state->total_param+100);
if (state->param == NULL) {
DEBUG(0,("reply_trans: param malloc fail for %u "
"bytes !\n", (unsigned int)state->total_param));
END_PROFILE(SMBtrans);
return(ERROR_DOS(ERRDOS,ERRnomem));
}
+ /* null-terminate the slack space */
+ memset(&state->param[state->total_param], 0, 100);
if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
goto bad_param;
if ((smb_base(inbuf)+psoff+pscnt > inbuf + size) ||
if ((state->received_param == state->total_param) &&
(state->received_data == state->total_data)) {
- result = handle_trans(conn, state, outbuf, &outsize);
+ result = handle_trans(conn, state, inbuf, outbuf, &outsize);
SAFE_FREE(state->data);
SAFE_FREE(state->param);
/* We need to send an interim response then receive the rest
of the parameter/data bytes */
- outsize = set_message(outbuf,0,0,True);
+ outsize = set_message(inbuf,outbuf,0,0,True);
show_msg(outbuf);
END_PROFILE(SMBtrans);
return outsize;
*/
SCVAL(outbuf,smb_com,SMBtrans);
- result = handle_trans(conn, state, outbuf, &outsize);
+ result = handle_trans(conn, state, inbuf, outbuf, &outsize);
DLIST_REMOVE(conn->pending_trans, state);
SAFE_FREE(state->data);
git.samba.org / kai / samba.git / blobdiff