source3/libsmb/clitrans.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client transaction calls
   4    Copyright (C) Andrew Tridgell 1994-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 */
  20
  21 #define NO_SYSLOG
  22
  23 #include "includes.h"
  24
  25
  26 /****************************************************************************
  27  Send a SMB trans or trans2 request.
  28 ****************************************************************************/
  29
  30 BOOL cli_send_trans(struct cli_state *cli, int trans,
  31                     const char *pipe_name,
  32                     int fid, int flags,
  33                     uint16 *setup, unsigned int lsetup, unsigned int msetup,
  34                     const char *param, unsigned int lparam, unsigned int mparam,
  35                     const char *data, unsigned int ldata, unsigned int mdata)
  36 {
  37         unsigned int i;
  38         unsigned int this_ldata,this_lparam;
  39         unsigned int tot_data=0,tot_param=0;
  40         char *outdata,*outparam;
  41         char *p;
  42         int pipe_name_len=0;
  43         uint16 mid;
  44
  45         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
  46         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
  47
  48         memset(cli->outbuf,'\0',smb_size);
  49         set_message(cli->outbuf,14+lsetup,0,True);
  50         SCVAL(cli->outbuf,smb_com,trans);
  51         SSVAL(cli->outbuf,smb_tid, cli->cnum);
  52         cli_setup_packet(cli);
  53
  54         /*
  55          * Save the mid we're using. We need this for finding
  56          * signing replies.
  57          */
  58
  59         mid = cli->mid;
  60
  61         if (pipe_name) {
  62                 pipe_name_len = clistr_push(cli, smb_buf(cli->outbuf), pipe_name, -1, STR_TERMINATE);
  63         }
  64
  65         outparam = smb_buf(cli->outbuf)+(trans==SMBtrans ? pipe_name_len : 3);
  66         outdata = outparam+this_lparam;
  67
  68         /* primary request */
  69         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
  70         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
  71         SSVAL(cli->outbuf,smb_mprcnt,mparam);   /* mprcnt */
  72         SSVAL(cli->outbuf,smb_mdrcnt,mdata);    /* mdrcnt */
  73         SCVAL(cli->outbuf,smb_msrcnt,msetup);   /* msrcnt */
  74         SSVAL(cli->outbuf,smb_flags,flags);     /* flags */
  75         SIVAL(cli->outbuf,smb_timeout,0);               /* timeout */
  76         SSVAL(cli->outbuf,smb_pscnt,this_lparam);       /* pscnt */
  77         SSVAL(cli->outbuf,smb_psoff,smb_offset(outparam,cli->outbuf)); /* psoff */
  78         SSVAL(cli->outbuf,smb_dscnt,this_ldata);        /* dscnt */
  79         SSVAL(cli->outbuf,smb_dsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
  80         SCVAL(cli->outbuf,smb_suwcnt,lsetup);   /* suwcnt */
  81         for (i=0;i<lsetup;i++)          /* setup[] */
  82                 SSVAL(cli->outbuf,smb_setup+i*2,setup[i]);
  83         p = smb_buf(cli->outbuf);
  84         if (trans != SMBtrans) {
  85                 *p++ = 0;  /* put in a null smb_name */
  86                 *p++ = 'D'; *p++ = ' '; /* observed in OS/2 */
  87         }
  88         if (this_lparam)                        /* param[] */
  89                 memcpy(outparam,param,this_lparam);
  90         if (this_ldata)                 /* data[] */
  91                 memcpy(outdata,data,this_ldata);
  92         cli_setup_bcc(cli, outdata+this_ldata);
  93
  94         show_msg(cli->outbuf);
  95
  96         if (!cli_send_smb(cli)) {
  97                 return False;
  98         }
  99
 100         if (this_ldata < ldata || this_lparam < lparam) {
 101                 /* receive interim response */
 102                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
 103                         return(False);
 104                 }
 105
 106                 tot_data = this_ldata;
 107                 tot_param = this_lparam;
 108
 109                 while (tot_data < ldata || tot_param < lparam)  {
 110                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 111                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 112
 113                         set_message(cli->outbuf,trans==SMBtrans?8:9,0,True);
 114                         SCVAL(cli->outbuf,smb_com,(trans==SMBtrans ? SMBtranss : SMBtranss2));
 115
 116                         outparam = smb_buf(cli->outbuf);
 117                         outdata = outparam+this_lparam;
 118
 119                         /* secondary request */
 120                         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
 121                         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
 122                         SSVAL(cli->outbuf,smb_spscnt,this_lparam);      /* pscnt */
 123                         SSVAL(cli->outbuf,smb_spsoff,smb_offset(outparam,cli->outbuf)); /* psoff */
 124                         SSVAL(cli->outbuf,smb_spsdisp,tot_param);       /* psdisp */
 125                         SSVAL(cli->outbuf,smb_sdscnt,this_ldata);       /* dscnt */
 126                         SSVAL(cli->outbuf,smb_sdsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
 127                         SSVAL(cli->outbuf,smb_sdsdisp,tot_data);        /* dsdisp */
 128                         if (trans==SMBtrans2)
 129                                 SSVALS(cli->outbuf,smb_sfid,fid);               /* fid */
 130                         if (this_lparam)                        /* param[] */
 131                                 memcpy(outparam,param+tot_param,this_lparam);
 132                         if (this_ldata)                 /* data[] */
 133                                 memcpy(outdata,data+tot_data,this_ldata);
 134                         cli_setup_bcc(cli, outdata+this_ldata);
 135
 136                         /*
 137                          * Save the mid we're using. We need this for finding
 138                          * signing replies.
 139                          */
 140                         mid = cli->mid;
 141
 142                         show_msg(cli->outbuf);
 143                         if (!cli_send_smb(cli)) {
 144                                 return False;
 145                         }
 146
 147                         /* Ensure we use the same mid for the secondaries. */
 148                         cli->mid = mid;
 149
 150                         tot_data += this_ldata;
 151                         tot_param += this_lparam;
 152                 }
 153         }
 154
 155         /* Note we're in a trans state. Save the sequence
 156          * numbers for replies. */
 157
 158         cli_signing_trans_start(cli, mid);
 159         return(True);
 160 }
 161
 162 /****************************************************************************
 163  Receive a SMB trans or trans2 response allocating the necessary memory.
 164 ****************************************************************************/
 165
 166 BOOL cli_receive_trans(struct cli_state *cli,int trans,
 167                               char **param, unsigned int *param_len,
 168                               char **data, unsigned int *data_len)
 169 {
 170         unsigned int total_data=0;
 171         unsigned int total_param=0;
 172         unsigned int this_data,this_param;
 173         NTSTATUS status;
 174         char *tdata;
 175         char *tparam;
 176
 177         *data_len = *param_len = 0;
 178
 179         if (!cli_receive_smb(cli)) {
 180                 cli_signing_trans_stop(cli);
 181                 return False;
 182         }
 183
 184         show_msg(cli->inbuf);
 185
 186         /* sanity check */
 187         if (CVAL(cli->inbuf,smb_com) != trans) {
 188                 DEBUG(0,("Expected %s response, got command 0x%02x\n",
 189                          trans==SMBtrans?"SMBtrans":"SMBtrans2",
 190                          CVAL(cli->inbuf,smb_com)));
 191                 cli_signing_trans_stop(cli);
 192                 return(False);
 193         }
 194
 195         /*
 196          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 197          * to a trans call. This is not an error and should not
 198          * be treated as such.
 199          */
 200         status = cli_nt_error(cli);
 201
 202         if (NT_STATUS_IS_ERR(status)) {
 203                 cli_signing_trans_stop(cli);
 204                 return False;
 205         }
 206
 207         /* parse out the lengths */
 208         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 209         total_param = SVAL(cli->inbuf,smb_tprcnt);
 210
 211         /* allocate it */
 212         if (total_data!=0) {
 213                 tdata = SMB_REALLOC(*data,total_data);
 214                 if (!tdata) {
 215                         DEBUG(0,("cli_receive_trans: failed to enlarge data buffer\n"));
 216                         cli_signing_trans_stop(cli);
 217                         return False;
 218                 }
 219                 else
 220                         *data = tdata;
 221         }
 222
 223         if (total_param!=0) {
 224                 tparam = SMB_REALLOC(*param,total_param);
 225                 if (!tparam) {
 226                         DEBUG(0,("cli_receive_trans: failed to enlarge param buffer\n"));
 227                         cli_signing_trans_stop(cli);
 228                         return False;
 229                 }
 230                 else
 231                         *param = tparam;
 232         }
 233
 234         for (;;)  {
 235                 this_data = SVAL(cli->inbuf,smb_drcnt);
 236                 this_param = SVAL(cli->inbuf,smb_prcnt);
 237
 238                 if (this_data + *data_len > total_data ||
 239                     this_param + *param_len > total_param) {
 240                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 241                         cli_signing_trans_stop(cli);
 242                         return False;
 243                 }
 244
 245                 if (this_data + *data_len < this_data ||
 246                                 this_data + *data_len < *data_len ||
 247                                 this_param + *param_len < this_param ||
 248                                 this_param + *param_len < *param_len) {
 249                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 250                         cli_signing_trans_stop(cli);
 251                         return False;
 252                 }
 253
 254                 if (this_data) {
 255                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_drdisp);
 256                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_droff);
 257
 258                         if (data_offset_out > total_data ||
 259                                         data_offset_out + this_data > total_data ||
 260                                         data_offset_out + this_data < data_offset_out ||
 261                                         data_offset_out + this_data < this_data) {
 262                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 263                                 cli_signing_trans_stop(cli);
 264                                 return False;
 265                         }
 266                         if (data_offset_in > cli->bufsize ||
 267                                         data_offset_in + this_data >  cli->bufsize ||
 268                                         data_offset_in + this_data < data_offset_in ||
 269                                         data_offset_in + this_data < this_data) {
 270                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 271                                 cli_signing_trans_stop(cli);
 272                                 return False;
 273                         }
 274
 275                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 276                 }
 277                 if (this_param) {
 278                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_prdisp);
 279                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_proff);
 280
 281                         if (param_offset_out > total_param ||
 282                                         param_offset_out + this_param > total_param ||
 283                                         param_offset_out + this_param < param_offset_out ||
 284                                         param_offset_out + this_param < this_param) {
 285                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 286                                 cli_signing_trans_stop(cli);
 287                                 return False;
 288                         }
 289                         if (param_offset_in > cli->bufsize ||
 290                                         param_offset_in + this_param >  cli->bufsize ||
 291                                         param_offset_in + this_param < param_offset_in ||
 292                                         param_offset_in + this_param < this_param) {
 293                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 294                                 cli_signing_trans_stop(cli);
 295                                 return False;
 296                         }
 297
 298                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 299                 }
 300                 *data_len += this_data;
 301                 *param_len += this_param;
 302
 303                 if (total_data <= *data_len && total_param <= *param_len)
 304                         break;
 305
 306                 if (!cli_receive_smb(cli)) {
 307                         cli_signing_trans_stop(cli);
 308                         return False;
 309                 }
 310
 311                 show_msg(cli->inbuf);
 312
 313                 /* sanity check */
 314                 if (CVAL(cli->inbuf,smb_com) != trans) {
 315                         DEBUG(0,("Expected %s response, got command 0x%02x\n",
 316                                  trans==SMBtrans?"SMBtrans":"SMBtrans2",
 317                                  CVAL(cli->inbuf,smb_com)));
 318                         cli_signing_trans_stop(cli);
 319                         return(False);
 320                 }
 321                 if (NT_STATUS_IS_ERR(cli_nt_error(cli))) {
 322                         cli_signing_trans_stop(cli);
 323                         return(False);
 324                 }
 325
 326                 /* parse out the total lengths again - they can shrink! */
 327                 if (SVAL(cli->inbuf,smb_tdrcnt) < total_data)
 328                         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 329                 if (SVAL(cli->inbuf,smb_tprcnt) < total_param)
 330                         total_param = SVAL(cli->inbuf,smb_tprcnt);
 331
 332                 if (total_data <= *data_len && total_param <= *param_len)
 333                         break;
 334
 335         }
 336
 337         cli_signing_trans_stop(cli);
 338         return(True);
 339 }
 340
 341 /****************************************************************************
 342  Send a SMB nttrans request.
 343 ****************************************************************************/
 344
 345 BOOL cli_send_nt_trans(struct cli_state *cli,
 346                        int function,
 347                        int flags,
 348                        uint16 *setup, unsigned int lsetup, unsigned int msetup,
 349                        char *param, unsigned int lparam, unsigned int mparam,
 350                        char *data, unsigned int ldata, unsigned int mdata)
 351 {
 352         unsigned int i;
 353         unsigned int this_ldata,this_lparam;
 354         unsigned int tot_data=0,tot_param=0;
 355         uint16 mid;
 356         char *outdata,*outparam;
 357
 358         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
 359         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
 360
 361         memset(cli->outbuf,'\0',smb_size);
 362         set_message(cli->outbuf,19+lsetup,0,True);
 363         SCVAL(cli->outbuf,smb_com,SMBnttrans);
 364         SSVAL(cli->outbuf,smb_tid, cli->cnum);
 365         cli_setup_packet(cli);
 366
 367         /*
 368          * Save the mid we're using. We need this for finding
 369          * signing replies.
 370          */
 371
 372         mid = cli->mid;
 373
 374         outparam = smb_buf(cli->outbuf)+3;
 375         outdata = outparam+this_lparam;
 376
 377         /* primary request */
 378         SCVAL(cli->outbuf,smb_nt_MaxSetupCount,msetup);
 379         SCVAL(cli->outbuf,smb_nt_Flags,flags);
 380         SIVAL(cli->outbuf,smb_nt_TotalParameterCount, lparam);
 381         SIVAL(cli->outbuf,smb_nt_TotalDataCount, ldata);
 382         SIVAL(cli->outbuf,smb_nt_MaxParameterCount, mparam);
 383         SIVAL(cli->outbuf,smb_nt_MaxDataCount, mdata);
 384         SIVAL(cli->outbuf,smb_nt_ParameterCount, this_lparam);
 385         SIVAL(cli->outbuf,smb_nt_ParameterOffset, smb_offset(outparam,cli->outbuf));
 386         SIVAL(cli->outbuf,smb_nt_DataCount, this_ldata);
 387         SIVAL(cli->outbuf,smb_nt_DataOffset, smb_offset(outdata,cli->outbuf));
 388         SIVAL(cli->outbuf,smb_nt_SetupCount, lsetup);
 389         SIVAL(cli->outbuf,smb_nt_Function, function);
 390         for (i=0;i<lsetup;i++)          /* setup[] */
 391                 SSVAL(cli->outbuf,smb_nt_SetupStart+i*2,setup[i]);
 392
 393         if (this_lparam)                        /* param[] */
 394                 memcpy(outparam,param,this_lparam);
 395         if (this_ldata)                 /* data[] */
 396                 memcpy(outdata,data,this_ldata);
 397
 398         cli_setup_bcc(cli, outdata+this_ldata);
 399
 400         show_msg(cli->outbuf);
 401         if (!cli_send_smb(cli)) {
 402                 return False;
 403         }
 404
 405         if (this_ldata < ldata || this_lparam < lparam) {
 406                 /* receive interim response */
 407                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
 408                         return(False);
 409                 }
 410
 411                 tot_data = this_ldata;
 412                 tot_param = this_lparam;
 413
 414                 while (tot_data < ldata || tot_param < lparam)  {
 415                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 416                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 417
 418                         set_message(cli->outbuf,18,0,True);
 419                         SCVAL(cli->outbuf,smb_com,SMBnttranss);
 420
 421                         /* XXX - these should probably be aligned */
 422                         outparam = smb_buf(cli->outbuf);
 423                         outdata = outparam+this_lparam;
 424
 425                         /* secondary request */
 426                         SIVAL(cli->outbuf,smb_nts_TotalParameterCount,lparam);
 427                         SIVAL(cli->outbuf,smb_nts_TotalDataCount,ldata);
 428                         SIVAL(cli->outbuf,smb_nts_ParameterCount,this_lparam);
 429                         SIVAL(cli->outbuf,smb_nts_ParameterOffset,smb_offset(outparam,cli->outbuf));
 430                         SIVAL(cli->outbuf,smb_nts_ParameterDisplacement,tot_param);
 431                         SIVAL(cli->outbuf,smb_nts_DataCount,this_ldata);
 432                         SIVAL(cli->outbuf,smb_nts_DataOffset,smb_offset(outdata,cli->outbuf));
 433                         SIVAL(cli->outbuf,smb_nts_DataDisplacement,tot_data);
 434                         if (this_lparam)                        /* param[] */
 435                                 memcpy(outparam,param+tot_param,this_lparam);
 436                         if (this_ldata)                 /* data[] */
 437                                 memcpy(outdata,data+tot_data,this_ldata);
 438                         cli_setup_bcc(cli, outdata+this_ldata);
 439
 440                         /*
 441                          * Save the mid we're using. We need this for finding
 442                          * signing replies.
 443                          */
 444                         mid = cli->mid;
 445
 446                         show_msg(cli->outbuf);
 447
 448                         if (!cli_send_smb(cli)) {
 449                                 return False;
 450                         }
 451
 452                         /* Ensure we use the same mid for the secondaries. */
 453                         cli->mid = mid;
 454
 455                         tot_data += this_ldata;
 456                         tot_param += this_lparam;
 457                 }
 458         }
 459
 460         /* Note we're in a trans state. Save the sequence
 461          * numbers for replies. */
 462
 463         cli_signing_trans_start(cli, mid);
 464         return(True);
 465 }
 466
 467 /****************************************************************************
 468   receive a SMB nttrans response allocating the necessary memory
 469   ****************************************************************************/
 470
 471 BOOL cli_receive_nt_trans(struct cli_state *cli,
 472                           char **param, unsigned int *param_len,
 473                           char **data, unsigned int *data_len)
 474 {
 475         unsigned int total_data=0;
 476         unsigned int total_param=0;
 477         unsigned int this_data,this_param;
 478         uint8 eclass;
 479         uint32 ecode;
 480         char *tdata;
 481         char *tparam;
 482
 483         *data_len = *param_len = 0;
 484
 485         if (!cli_receive_smb(cli)) {
 486                 cli_signing_trans_stop(cli);
 487                 return False;
 488         }
 489
 490         show_msg(cli->inbuf);
 491
 492         /* sanity check */
 493         if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 494                 DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 495                          CVAL(cli->inbuf,smb_com)));
 496                 cli_signing_trans_stop(cli);
 497                 return(False);
 498         }
 499
 500         /*
 501          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 502          * to a trans call. This is not an error and should not
 503          * be treated as such.
 504          */
 505         if (cli_is_dos_error(cli)) {
 506                 cli_dos_error(cli, &eclass, &ecode);
 507                 if (cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata)) {
 508                         cli_signing_trans_stop(cli);
 509                         return(False);
 510                 }
 511         }
 512
 513         /*
 514          * Likewise for NT_STATUS_BUFFER_TOO_SMALL
 515          */
 516         if (cli_is_nt_error(cli)) {
 517                 if (!NT_STATUS_EQUAL(cli_nt_error(cli),
 518                                      NT_STATUS_BUFFER_TOO_SMALL)) {
 519                         cli_signing_trans_stop(cli);
 520                         return(False);
 521                 }
 522         }
 523
 524         /* parse out the lengths */
 525         total_data = SVAL(cli->inbuf,smb_ntr_TotalDataCount);
 526         total_param = SVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 527
 528         /* allocate it */
 529         if (total_data) {
 530                 tdata = SMB_REALLOC(*data,total_data);
 531                 if (!tdata) {
 532                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge data buffer to %d\n",total_data));
 533                         cli_signing_trans_stop(cli);
 534                         return False;
 535                 } else {
 536                         *data = tdata;
 537                 }
 538         }
 539
 540         if (total_param) {
 541                 tparam = SMB_REALLOC(*param,total_param);
 542                 if (!tparam) {
 543                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge param buffer to %d\n", total_param));
 544                         cli_signing_trans_stop(cli);
 545                         return False;
 546                 } else {
 547                         *param = tparam;
 548                 }
 549         }
 550
 551         while (1)  {
 552                 this_data = SVAL(cli->inbuf,smb_ntr_DataCount);
 553                 this_param = SVAL(cli->inbuf,smb_ntr_ParameterCount);
 554
 555                 if (this_data + *data_len > total_data ||
 556                     this_param + *param_len > total_param) {
 557                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 558                         cli_signing_trans_stop(cli);
 559                         return False;
 560                 }
 561
 562                 if (this_data + *data_len < this_data ||
 563                                 this_data + *data_len < *data_len ||
 564                                 this_param + *param_len < this_param ||
 565                                 this_param + *param_len < *param_len) {
 566                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 567                         cli_signing_trans_stop(cli);
 568                         return False;
 569                 }
 570
 571                 if (this_data) {
 572                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_ntr_DataDisplacement);
 573                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_ntr_DataOffset);
 574
 575                         if (data_offset_out > total_data ||
 576                                         data_offset_out + this_data > total_data ||
 577                                         data_offset_out + this_data < data_offset_out ||
 578                                         data_offset_out + this_data < this_data) {
 579                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 580                                 cli_signing_trans_stop(cli);
 581                                 return False;
 582                         }
 583                         if (data_offset_in > cli->bufsize ||
 584                                         data_offset_in + this_data >  cli->bufsize ||
 585                                         data_offset_in + this_data < data_offset_in ||
 586                                         data_offset_in + this_data < this_data) {
 587                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 588                                 cli_signing_trans_stop(cli);
 589                                 return False;
 590                         }
 591
 592                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 593                 }
 594
 595                 if (this_param) {
 596                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_ntr_ParameterDisplacement);
 597                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_ntr_ParameterOffset);
 598
 599                         if (param_offset_out > total_param ||
 600                                         param_offset_out + this_param > total_param ||
 601                                         param_offset_out + this_param < param_offset_out ||
 602                                         param_offset_out + this_param < this_param) {
 603                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 604                                 cli_signing_trans_stop(cli);
 605                                 return False;
 606                         }
 607                         if (param_offset_in > cli->bufsize ||
 608                                         param_offset_in + this_param >  cli->bufsize ||
 609                                         param_offset_in + this_param < param_offset_in ||
 610                                         param_offset_in + this_param < this_param) {
 611                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 612                                 cli_signing_trans_stop(cli);
 613                                 return False;
 614                         }
 615
 616                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 617                 }
 618
 619                 *data_len += this_data;
 620                 *param_len += this_param;
 621
 622                 if (total_data <= *data_len && total_param <= *param_len)
 623                         break;
 624
 625                 if (!cli_receive_smb(cli)) {
 626                         cli_signing_trans_stop(cli);
 627                         return False;
 628                 }
 629
 630                 show_msg(cli->inbuf);
 631
 632                 /* sanity check */
 633                 if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 634                         DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 635                                  CVAL(cli->inbuf,smb_com)));
 636                         cli_signing_trans_stop(cli);
 637                         return(False);
 638                 }
 639                 if (cli_is_dos_error(cli)) {
 640                         cli_dos_error(cli, &eclass, &ecode);
 641                         if(cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata)) {
 642                                 cli_signing_trans_stop(cli);
 643                                 return(False);
 644                         }
 645                 }
 646                 /* parse out the total lengths again - they can shrink! */
 647                 if (SVAL(cli->inbuf,smb_ntr_TotalDataCount) < total_data)
 648                         total_data = SVAL(cli->inbuf,smb_ntr_TotalDataCount);
 649                 if (SVAL(cli->inbuf,smb_ntr_TotalParameterCount) < total_param)
 650                         total_param = SVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 651
 652                 if (total_data <= *data_len && total_param <= *param_len)
 653                         break;
 654         }
 655
 656         cli_signing_trans_stop(cli);
 657         return(True);
 658 }