s3: Fix stream marshalling to return the correct streaminfo status

When there are enough streams on a file to fill up the max_data_count
when responding to a trans2 streaminfo, samba is returning
NT_STATUS_BUFFER_TOO_SMALL.  Windows handles this by returning
NT_STATUS_BUFFER_OVERFLOW while still sending as much of the data that
it can fit into the buffer.  When the windows client sees
BUFFER_OVERFLOW, it retries the streaminfo with a larger buffer (2x).
The windows client starts at 2K and will continue increasing the
buffer size by two until it reaches 64K.  If the streams don't fit in
64K the windows client seems to give up.

This patch fixes marshall_stream_info to overfill the buffer by 1
stream so that send_trans2_replies can properly detect the overflow
and return the correct status.
(cherry picked from commit 3643a1179df42d47c2913c7d5c6a4ec8d8b8eb9d)

diff --git a/source/smbd/trans2.c b/source/smbd/trans2.c
index 406cc4e56fe8742f2f92fb14efe26de38e686bcc..c27464a945406465f006081883158c55d03f16f5 100644 (file)
--- a/source/smbd/trans2.c
+++ b/source/smbd/trans2.c
@@ -3679,7 +3679,7 @@ static NTSTATUS marshall_stream_info(unsigned int num_streams,
        unsigned int i;
        unsigned int ofs = 0;
 
-       for (i=0; i<num_streams; i++) {
+       for (i = 0; i < num_streams && ofs <= max_data_bytes; i++) {
                unsigned int next_offset;
                size_t namelen;
                smb_ucs2_t *namebuf;
@@ -3698,11 +3698,6 @@ static NTSTATUS marshall_stream_info(unsigned int num_streams,
 
                namelen -= 2;
 
-               if (ofs + 24 + namelen > max_data_bytes) {
-                       TALLOC_FREE(namebuf);
-                       return NT_STATUS_BUFFER_TOO_SMALL;
-               }
-
                SIVAL(data, ofs+4, namelen);
                SOFF_T(data, ofs+8, streams[i].size);
                SOFF_T(data, ofs+16, streams[i].alloc_size);
@@ -3717,10 +3712,6 @@ static NTSTATUS marshall_stream_info(unsigned int num_streams,
                else {
                        unsigned int align = ndr_align_size(next_offset, 8);
 
-                       if (next_offset + align > max_data_bytes) {
-                               return NT_STATUS_BUFFER_TOO_SMALL;
-                       }
-
                        memset(data+next_offset, 0, align);
                        next_offset += align;