r13915: Fixed a very interesting class of realloc() bugs found by Coverity.
[samba.git] / source3 / libsmb / clireadwrite.c
1 /* 
2    Unix SMB/CIFS implementation.
3    client file read/write routines
4    Copyright (C) Andrew Tridgell 1994-1998
5    
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License as published by
8    the Free Software Foundation; either version 2 of the License, or
9    (at your option) any later version.
10    
11    This program is distributed in the hope that it will be useful,
12    but WITHOUT ANY WARRANTY; without even the implied warranty of
13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14    GNU General Public License for more details.
15    
16    You should have received a copy of the GNU General Public License
17    along with this program; if not, write to the Free Software
18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19 */
20
21 #include "includes.h"
22
23 /****************************************************************************
24 Issue a single SMBread and don't wait for a reply.
25 ****************************************************************************/
26
27 static BOOL cli_issue_read(struct cli_state *cli, int fnum, off_t offset, 
28                            size_t size, int i)
29 {
30         BOOL bigoffset = False;
31
32         memset(cli->outbuf,'\0',smb_size);
33         memset(cli->inbuf,'\0',smb_size);
34
35         if ((SMB_BIG_UINT)offset >> 32) 
36                 bigoffset = True;
37
38         set_message(cli->outbuf,bigoffset ? 12 : 10,0,True);
39                 
40         SCVAL(cli->outbuf,smb_com,SMBreadX);
41         SSVAL(cli->outbuf,smb_tid,cli->cnum);
42         cli_setup_packet(cli);
43
44         SCVAL(cli->outbuf,smb_vwv0,0xFF);
45         SSVAL(cli->outbuf,smb_vwv2,fnum);
46         SIVAL(cli->outbuf,smb_vwv3,offset);
47         SSVAL(cli->outbuf,smb_vwv5,size);
48         SSVAL(cli->outbuf,smb_vwv6,size);
49         SSVAL(cli->outbuf,smb_vwv7,((size >> 16) & 1));
50         SSVAL(cli->outbuf,smb_mid,cli->mid + i);
51
52         if (bigoffset) {
53                 SIVAL(cli->outbuf,smb_vwv10,(((SMB_BIG_UINT)offset)>>32) & 0xffffffff);
54         }
55
56         return cli_send_smb(cli);
57 }
58
59 /****************************************************************************
60   Read size bytes at offset offset using SMBreadX.
61 ****************************************************************************/
62
63 ssize_t cli_read(struct cli_state *cli, int fnum, char *buf, off_t offset, size_t size)
64 {
65         char *p;
66         int size2;
67         int readsize;
68         ssize_t total = 0;
69
70         if (size == 0) 
71                 return 0;
72
73         /*
74          * Set readsize to the maximum size we can handle in one readX,
75          * rounded down to a multiple of 1024.
76          */
77
78         if (cli->capabilities & CAP_LARGE_READX) {
79                 readsize = CLI_MAX_LARGE_READX_SIZE;
80         } else {
81                 readsize = (cli->max_xmit - (smb_size+32)) & ~1023;
82         }
83
84         while (total < size) {
85                 readsize = MIN(readsize, size-total);
86
87                 /* Issue a read and receive a reply */
88
89                 if (!cli_issue_read(cli, fnum, offset, readsize, 0))
90                         return -1;
91
92                 if (!cli_receive_smb(cli))
93                         return -1;
94
95                 /* Check for error.  Make sure to check for DOS and NT
96                    errors. */
97
98                 if (cli_is_error(cli)) {
99                         BOOL recoverable_error = False;
100                         NTSTATUS status = NT_STATUS_OK;
101                         uint8 eclass = 0;
102                         uint32 ecode = 0;
103
104                         if (cli_is_nt_error(cli))
105                                 status = cli_nt_error(cli);
106                         else
107                                 cli_dos_error(cli, &eclass, &ecode);
108
109                         /*
110                          * ERRDOS ERRmoredata or STATUS_MORE_ENRTIES is a
111                          * recoverable error, plus we have valid data in the
112                          * packet so don't error out here.
113                          */
114
115                         if ((eclass == ERRDOS && ecode == ERRmoredata) ||
116                             NT_STATUS_V(status) == NT_STATUS_V(STATUS_MORE_ENTRIES))
117                                 recoverable_error = True;
118
119                         if (!recoverable_error)
120                                 return -1;
121                 }
122
123                 size2 = SVAL(cli->inbuf, smb_vwv5);
124                 size2 |= (((unsigned int)(SVAL(cli->inbuf, smb_vwv7) & 1)) << 16);
125
126                 if (size2 > readsize) {
127                         DEBUG(5,("server returned more than we wanted!\n"));
128                         return -1;
129                 } else if (size2 < 0) {
130                         DEBUG(5,("read return < 0!\n"));
131                         return -1;
132                 }
133
134                 /* Copy data into buffer */
135
136                 p = smb_base(cli->inbuf) + SVAL(cli->inbuf,smb_vwv6);
137                 memcpy(buf + total, p, size2);
138
139                 total += size2;
140                 offset += size2;
141
142                 /*
143                  * If the server returned less than we asked for we're at EOF.
144                  */
145
146                 if (size2 < readsize)
147                         break;
148         }
149
150         return total;
151 }
152
153 #if 0  /* relies on client_receive_smb(), now a static in libsmb/clientgen.c */
154
155 /* This call is INCOMPATIBLE with SMB signing.  If you remove the #if 0
156    you must fix ensure you don't attempt to sign the packets - data
157    *will* be currupted */
158
159 /****************************************************************************
160 Issue a single SMBreadraw and don't wait for a reply.
161 ****************************************************************************/
162
163 static BOOL cli_issue_readraw(struct cli_state *cli, int fnum, off_t offset, 
164                            size_t size, int i)
165 {
166
167         if (!cli->sign_info.use_smb_signing) {
168                 DEBUG(0, ("Cannot use readraw and SMB Signing\n"));
169                 return False;
170         }
171         
172         memset(cli->outbuf,'\0',smb_size);
173         memset(cli->inbuf,'\0',smb_size);
174
175         set_message(cli->outbuf,10,0,True);
176                 
177         SCVAL(cli->outbuf,smb_com,SMBreadbraw);
178         SSVAL(cli->outbuf,smb_tid,cli->cnum);
179         cli_setup_packet(cli);
180
181         SSVAL(cli->outbuf,smb_vwv0,fnum);
182         SIVAL(cli->outbuf,smb_vwv1,offset);
183         SSVAL(cli->outbuf,smb_vwv2,size);
184         SSVAL(cli->outbuf,smb_vwv3,size);
185         SSVAL(cli->outbuf,smb_mid,cli->mid + i);
186
187         return cli_send_smb(cli);
188 }
189
190 /****************************************************************************
191  Tester for the readraw call.
192 ****************************************************************************/
193
194 ssize_t cli_readraw(struct cli_state *cli, int fnum, char *buf, off_t offset, size_t size)
195 {
196         char *p;
197         int size2;
198         size_t readsize;
199         ssize_t total = 0;
200
201         if (size == 0) 
202                 return 0;
203
204         /*
205          * Set readsize to the maximum size we can handle in one readraw.
206          */
207
208         readsize = 0xFFFF;
209
210         while (total < size) {
211                 readsize = MIN(readsize, size-total);
212
213                 /* Issue a read and receive a reply */
214
215                 if (!cli_issue_readraw(cli, fnum, offset, readsize, 0))
216                         return -1;
217
218                 if (!client_receive_smb(cli->fd, cli->inbuf, cli->timeout))
219                         return -1;
220
221                 size2 = smb_len(cli->inbuf);
222
223                 if (size2 > readsize) {
224                         DEBUG(5,("server returned more than we wanted!\n"));
225                         return -1;
226                 } else if (size2 < 0) {
227                         DEBUG(5,("read return < 0!\n"));
228                         return -1;
229                 }
230
231                 /* Copy data into buffer */
232
233                 if (size2) {
234                         p = cli->inbuf + 4;
235                         memcpy(buf + total, p, size2);
236                 }
237
238                 total += size2;
239                 offset += size2;
240
241                 /*
242                  * If the server returned less than we asked for we're at EOF.
243                  */
244
245                 if (size2 < readsize)
246                         break;
247         }
248
249         return total;
250 }
251 #endif
252 /****************************************************************************
253 issue a single SMBwrite and don't wait for a reply
254 ****************************************************************************/
255
256 static BOOL cli_issue_write(struct cli_state *cli, int fnum, off_t offset, 
257                             uint16 mode, const char *buf,
258                             size_t size, int i)
259 {
260         char *p;
261         BOOL large_writex = False;
262
263         if (size > cli->bufsize) {
264                 cli->outbuf = SMB_REALLOC(cli->outbuf, size + 1024);
265                 if (!cli->outbuf) {
266                         return False;
267                 }
268                 cli->inbuf = SMB_REALLOC(cli->inbuf, size + 1024);
269                 if (cli->inbuf == NULL) {
270                         SAFE_FREE(cli->outbuf);
271                         return False;
272                 }
273                 cli->bufsize = size + 1024;
274         }
275
276         memset(cli->outbuf,'\0',smb_size);
277         memset(cli->inbuf,'\0',smb_size);
278
279         if (((SMB_BIG_UINT)offset >> 32) || (size > 0xFFFF)) {
280                 large_writex = True;
281         }
282
283         if (large_writex)
284                 set_message(cli->outbuf,14,0,True);
285         else
286                 set_message(cli->outbuf,12,0,True);
287         
288         SCVAL(cli->outbuf,smb_com,SMBwriteX);
289         SSVAL(cli->outbuf,smb_tid,cli->cnum);
290         cli_setup_packet(cli);
291         
292         SCVAL(cli->outbuf,smb_vwv0,0xFF);
293         SSVAL(cli->outbuf,smb_vwv2,fnum);
294
295         SIVAL(cli->outbuf,smb_vwv3,offset);
296         SIVAL(cli->outbuf,smb_vwv5,0);
297         SSVAL(cli->outbuf,smb_vwv7,mode);
298
299         SSVAL(cli->outbuf,smb_vwv8,(mode & 0x0008) ? size : 0);
300         /*
301          * According to CIFS-TR-1p00, this following field should only
302          * be set if CAP_LARGE_WRITEX is set. We should check this
303          * locally. However, this check might already have been
304          * done by our callers.
305          */
306         SSVAL(cli->outbuf,smb_vwv9,((size>>16)&1));
307         SSVAL(cli->outbuf,smb_vwv10,size);
308         SSVAL(cli->outbuf,smb_vwv11,
309               smb_buf(cli->outbuf) - smb_base(cli->outbuf));
310
311         if (large_writex) {
312                 SIVAL(cli->outbuf,smb_vwv12,(((SMB_BIG_UINT)offset)>>32) & 0xffffffff);
313         }
314         
315         p = smb_base(cli->outbuf) + SVAL(cli->outbuf,smb_vwv11);
316         memcpy(p, buf, size);
317         cli_setup_bcc(cli, p+size);
318
319         SSVAL(cli->outbuf,smb_mid,cli->mid + i);
320         
321         show_msg(cli->outbuf);
322         return cli_send_smb(cli);
323 }
324
325 /****************************************************************************
326   write to a file
327   write_mode: 0x0001 disallow write cacheing
328               0x0002 return bytes remaining
329               0x0004 use raw named pipe protocol
330               0x0008 start of message mode named pipe protocol
331 ****************************************************************************/
332
333 ssize_t cli_write(struct cli_state *cli,
334                  int fnum, uint16 write_mode,
335                  const char *buf, off_t offset, size_t size)
336 {
337         ssize_t bwritten = 0;
338         unsigned int issued = 0;
339         unsigned int received = 0;
340         int mpx = 1;
341         int block = cli->max_xmit - (smb_size+32);
342         int blocks = (size + (block-1)) / block;
343
344         if(cli->max_mux > 1) {
345                 mpx = cli->max_mux-1;
346         } else {
347                 mpx = 1;
348         }
349
350         while (received < blocks) {
351
352                 while ((issued - received < mpx) && (issued < blocks)) {
353                         ssize_t bsent = issued * block;
354                         ssize_t size1 = MIN(block, size - bsent);
355
356                         if (!cli_issue_write(cli, fnum, offset + bsent,
357                                         write_mode,
358                                         buf + bsent,
359                                         size1, issued))
360                                 return -1;
361                         issued++;
362                 }
363
364                 if (!cli_receive_smb(cli))
365                         return bwritten;
366
367                 received++;
368
369                 if (cli_is_error(cli))
370                         break;
371
372                 bwritten += SVAL(cli->inbuf, smb_vwv2);
373                 bwritten += (((int)(SVAL(cli->inbuf, smb_vwv4)))<<16);
374         }
375
376         while (received < issued && cli_receive_smb(cli))
377                 received++;
378         
379         return bwritten;
380 }
381
382 /****************************************************************************
383   write to a file using a SMBwrite and not bypassing 0 byte writes
384 ****************************************************************************/
385
386 ssize_t cli_smbwrite(struct cli_state *cli,
387                      int fnum, char *buf, off_t offset, size_t size1)
388 {
389         char *p;
390         ssize_t total = 0;
391
392         do {
393                 size_t size = MIN(size1, cli->max_xmit - 48);
394                 
395                 memset(cli->outbuf,'\0',smb_size);
396                 memset(cli->inbuf,'\0',smb_size);
397
398                 set_message(cli->outbuf,5, 0,True);
399
400                 SCVAL(cli->outbuf,smb_com,SMBwrite);
401                 SSVAL(cli->outbuf,smb_tid,cli->cnum);
402                 cli_setup_packet(cli);
403                 
404                 SSVAL(cli->outbuf,smb_vwv0,fnum);
405                 SSVAL(cli->outbuf,smb_vwv1,size);
406                 SIVAL(cli->outbuf,smb_vwv2,offset);
407                 SSVAL(cli->outbuf,smb_vwv4,0);
408                 
409                 p = smb_buf(cli->outbuf);
410                 *p++ = 1;
411                 SSVAL(p, 0, size); p += 2;
412                 memcpy(p, buf, size); p += size;
413
414                 cli_setup_bcc(cli, p);
415                 
416                 if (!cli_send_smb(cli))
417                         return -1;
418
419                 if (!cli_receive_smb(cli))
420                         return -1;
421                 
422                 if (cli_is_error(cli))
423                         return -1;
424
425                 size = SVAL(cli->inbuf,smb_vwv0);
426                 if (size == 0)
427                         break;
428
429                 size1 -= size;
430                 total += size;
431                 offset += size;
432
433         } while (size1);
434
435         return total;
436 }