s3-talloc Change TALLOC_ARRAY() to talloc_array()
[samba.git] / source3 / smbd / ipc.c
index 68a13d692f6189fb9b7a6b270767109175cdc574..b452000e13921ddbac3689d39d32cfaacf28d5b9 100644 (file)
@@ -5,17 +5,17 @@
 
    SMB Version handling
    Copyright (C) John H Terpstra 1995-1998
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
    */
    */
 
 #include "includes.h"
-
-extern int max_send;
+#include "smbd/smbd.h"
+#include "smbd/globals.h"
+#include "smbprofile.h"
+#include "rpc_server/srv_pipe_hnd.h"
 
 #define NERR_notsupported 50
 
@@ -82,7 +84,7 @@ static void copy_trans_params_and_data(char *outbuf, int align,
  ****************************************************************************/
 
 void send_trans_reply(connection_struct *conn,
-                       struct smb_request *req,
+                     struct smb_request *req,
                      char *rparam, int rparam_len,
                      char *rdata, int rdata_len,
                      bool buffer_too_large)
@@ -94,6 +96,8 @@ void send_trans_reply(connection_struct *conn,
 
        int ldata  = rdata  ? rdata_len : 0;
        int lparam = rparam ? rparam_len : 0;
+       struct smbd_server_connection *sconn = req->sconn;
+       int max_send = sconn->smb1.sessions.max_send;
 
        if (buffer_too_large)
                DEBUG(5,("send_trans_reply: buffer %d too large\n", ldata ));
@@ -105,6 +109,12 @@ void send_trans_reply(connection_struct *conn,
 
        reply_outbuf(req, 10, 1+align+this_ldata+this_lparam);
 
+       /*
+        * We might have SMBtranss in req which was transferred to the outbuf,
+        * fix that.
+        */
+       SCVAL(req->outbuf, smb_com, SMBtrans);
+
        copy_trans_params_and_data((char *)req->outbuf, align,
                                rparam, tot_param_sent, this_lparam,
                                rdata, tot_data_sent, this_ldata);
@@ -112,28 +122,27 @@ void send_trans_reply(connection_struct *conn,
        SSVAL(req->outbuf,smb_vwv0,lparam);
        SSVAL(req->outbuf,smb_vwv1,ldata);
        SSVAL(req->outbuf,smb_vwv3,this_lparam);
-       SSVAL(req->outbuf,smb_vwv4,smb_offset(smb_buf(req->outbuf)+1,
-                                             req->outbuf));
+       SSVAL(req->outbuf,smb_vwv4,
+             smb_offset(smb_buf(req->outbuf)+1, req->outbuf));
        SSVAL(req->outbuf,smb_vwv5,0);
        SSVAL(req->outbuf,smb_vwv6,this_ldata);
-       SSVAL(req->outbuf,smb_vwv7,smb_offset(smb_buf(req->outbuf)+1+
-                                             this_lparam+align,
-                                             req->outbuf));
+       SSVAL(req->outbuf,smb_vwv7,
+             smb_offset(smb_buf(req->outbuf)+1+this_lparam+align,
+                        req->outbuf));
        SSVAL(req->outbuf,smb_vwv8,0);
        SSVAL(req->outbuf,smb_vwv9,0);
 
        if (buffer_too_large) {
-               error_packet_set((char *)req->outbuf,
-                                ERRDOS, ERRmoredata,
-                                STATUS_BUFFER_OVERFLOW,
-                                __LINE__, __FILE__);
+               error_packet_set((char *)req->outbuf, ERRDOS, ERRmoredata,
+                                STATUS_BUFFER_OVERFLOW, __LINE__, __FILE__);
        }
 
        show_msg((char *)req->outbuf);
-       if (!srv_send_smb(smbd_server_fd(),
-                       (char *)req->outbuf,
-                       IS_CONN_ENCRYPTED(conn)))
+       if (!srv_send_smb(sconn, (char *)req->outbuf,
+                         true, req->seqnum+1,
+                         IS_CONN_ENCRYPTED(conn), &req->pcd)) {
                exit_server_cleanly("send_trans_reply: srv_send_smb failed.");
+       }
 
        TALLOC_FREE(req->outbuf);
 
@@ -142,8 +151,10 @@ void send_trans_reply(connection_struct *conn,
 
        while (tot_data_sent < ldata || tot_param_sent < lparam)
        {
-               this_lparam = MIN(lparam-tot_param_sent, max_send - 500); /* hack */
-               this_ldata  = MIN(ldata -tot_data_sent, max_send - (500+this_lparam));
+               this_lparam = MIN(lparam-tot_param_sent,
+                                 max_send - 500); /* hack */
+               this_ldata  = MIN(ldata -tot_data_sent,
+                                 max_send - (500+this_lparam));
 
                if(this_lparam < 0)
                        this_lparam = 0;
@@ -153,20 +164,29 @@ void send_trans_reply(connection_struct *conn,
 
                align = (this_lparam%4);
 
-               reply_outbuf(req, 10, 1+this_ldata+this_lparam+align);
+               reply_outbuf(req, 10, 1+align+this_ldata+this_lparam);
+
+               /*
+                * We might have SMBtranss in req which was transferred to the
+                * outbuf, fix that.
+                */
+               SCVAL(req->outbuf, smb_com, SMBtrans);
 
                copy_trans_params_and_data((char *)req->outbuf, align,
                                           rparam, tot_param_sent, this_lparam,
                                           rdata, tot_data_sent, this_ldata);
-               
+
+               SSVAL(req->outbuf,smb_vwv0,lparam);
+               SSVAL(req->outbuf,smb_vwv1,ldata);
+
                SSVAL(req->outbuf,smb_vwv3,this_lparam);
-               SSVAL(req->outbuf,smb_vwv4,smb_offset(smb_buf(req->outbuf)+1,
-                                                     req->outbuf));
+               SSVAL(req->outbuf,smb_vwv4,
+                     smb_offset(smb_buf(req->outbuf)+1,req->outbuf));
                SSVAL(req->outbuf,smb_vwv5,tot_param_sent);
                SSVAL(req->outbuf,smb_vwv6,this_ldata);
-               SSVAL(req->outbuf,smb_vwv7,smb_offset(smb_buf(req->outbuf)+1+
-                                                     this_lparam+align,
-                                                     req->outbuf));
+               SSVAL(req->outbuf,smb_vwv7,
+                     smb_offset(smb_buf(req->outbuf)+1+this_lparam+align,
+                                req->outbuf));
                SSVAL(req->outbuf,smb_vwv8,tot_data_sent);
                SSVAL(req->outbuf,smb_vwv9,0);
 
@@ -178,10 +198,11 @@ void send_trans_reply(connection_struct *conn,
                }
 
                show_msg((char *)req->outbuf);
-               if (!srv_send_smb(smbd_server_fd(),
-                               (char *)req->outbuf,
-                               IS_CONN_ENCRYPTED(conn)))
-                       exit_server_cleanly("send_trans_reply: srv_send_smb failed.");
+               if (!srv_send_smb(sconn, (char *)req->outbuf,
+                                 true, req->seqnum+1,
+                                 IS_CONN_ENCRYPTED(conn), &req->pcd))
+                       exit_server_cleanly("send_trans_reply: srv_send_smb "
+                                           "failed.");
 
                tot_data_sent  += this_ldata;
                tot_param_sent += this_lparam;
@@ -193,53 +214,168 @@ void send_trans_reply(connection_struct *conn,
  Start the first part of an RPC reply which began with an SMBtrans request.
 ****************************************************************************/
 
-static void api_rpc_trans_reply(connection_struct *conn, struct smb_request *req, smb_np_struct *p)
+struct dcerpc_cmd_state {
+       struct fake_file_handle *handle;
+       uint8_t *data;
+       size_t num_data;
+       size_t max_read;
+};
+
+static void api_dcerpc_cmd_write_done(struct tevent_req *subreq);
+static void api_dcerpc_cmd_read_done(struct tevent_req *subreq);
+
+static void api_dcerpc_cmd(connection_struct *conn, struct smb_request *req,
+                          files_struct *fsp, uint8_t *data, size_t length,
+                          size_t max_read)
 {
-       bool is_data_outstanding;
-       char *rdata = (char *)SMB_MALLOC(p->max_trans_reply);
-       int data_len;
+       struct tevent_req *subreq;
+       struct dcerpc_cmd_state *state;
+       bool busy;
+
+       if (!fsp_is_np(fsp)) {
+               api_no_reply(conn, req);
+               return;
+       }
+
+       /*
+        * Trans requests are only allowed
+        * if no other Trans or Read is active
+        */
+       busy = np_read_in_progress(fsp->fake_file_handle);
+       if (busy) {
+               reply_nterror(req, NT_STATUS_PIPE_BUSY);
+               return;
+       }
+
+       state = talloc(req, struct dcerpc_cmd_state);
+       if (state == NULL) {
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               return;
+       }
+       req->async_priv = state;
+
+       state->handle = fsp->fake_file_handle;
 
-       if(rdata == NULL) {
-               DEBUG(0,("api_rpc_trans_reply: malloc fail.\n"));
+       /*
+        * This memdup severely sucks. But doing it properly essentially means
+        * to rewrite lanman.c, something which I don't really want to do now.
+        */
+       state->data = (uint8_t *)talloc_memdup(state, data, length);
+       if (state->data == NULL) {
                reply_nterror(req, NT_STATUS_NO_MEMORY);
                return;
        }
+       state->num_data = length;
+       state->max_read = max_read;
 
-       if((data_len = read_from_pipe( p, rdata, p->max_trans_reply,
-                                       &is_data_outstanding)) < 0) {
-               SAFE_FREE(rdata);
-               api_no_reply(conn,req);
+       subreq = np_write_send(state, server_event_context(), state->handle,
+                              state->data, length);
+       if (subreq == NULL) {
+               TALLOC_FREE(state);
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
                return;
        }
+       tevent_req_set_callback(subreq, api_dcerpc_cmd_write_done,
+                               talloc_move(conn, &req));
+}
+
+static void api_dcerpc_cmd_write_done(struct tevent_req *subreq)
+{
+       struct smb_request *req = tevent_req_callback_data(
+               subreq, struct smb_request);
+       struct dcerpc_cmd_state *state = talloc_get_type_abort(
+               req->async_priv, struct dcerpc_cmd_state);
+       NTSTATUS status;
+       ssize_t nwritten = -1;
+
+       status = np_write_recv(subreq, &nwritten);
+       TALLOC_FREE(subreq);
+       if (!NT_STATUS_IS_OK(status) || (nwritten != state->num_data)) {
+               DEBUG(10, ("Could not write to pipe: %s (%d/%d)\n",
+                          nt_errstr(status), (int)state->num_data,
+                          (int)nwritten));
+               reply_nterror(req, NT_STATUS_PIPE_NOT_AVAILABLE);
+               goto send;
+       }
+
+       state->data = talloc_realloc(state, state->data, uint8_t,
+                                          state->max_read);
+       if (state->data == NULL) {
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               goto send;
+       }
 
-       send_trans_reply(conn, req, NULL, 0, rdata, data_len, is_data_outstanding);
-       SAFE_FREE(rdata);
+       subreq = np_read_send(req->conn, server_event_context(),
+                             state->handle, state->data, state->max_read);
+       if (subreq == NULL) {
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               goto send;
+       }
+       tevent_req_set_callback(subreq, api_dcerpc_cmd_read_done, req);
        return;
+
+ send:
+       if (!srv_send_smb(
+                   req->sconn, (char *)req->outbuf,
+                   true, req->seqnum+1,
+                   IS_CONN_ENCRYPTED(req->conn) || req->encrypted,
+                   &req->pcd)) {
+               exit_server_cleanly("api_dcerpc_cmd_write_done: "
+                                   "srv_send_smb failed.");
+       }
+       TALLOC_FREE(req);
+}
+
+static void api_dcerpc_cmd_read_done(struct tevent_req *subreq)
+{
+       struct smb_request *req = tevent_req_callback_data(
+               subreq, struct smb_request);
+       struct dcerpc_cmd_state *state = talloc_get_type_abort(
+               req->async_priv, struct dcerpc_cmd_state);
+       NTSTATUS status;
+       ssize_t nread;
+       bool is_data_outstanding;
+
+       status = np_read_recv(subreq, &nread, &is_data_outstanding);
+       TALLOC_FREE(subreq);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(10, ("Could not read from to pipe: %s\n",
+                          nt_errstr(status)));
+               reply_nterror(req, status);
+
+               if (!srv_send_smb(req->sconn, (char *)req->outbuf,
+                                 true, req->seqnum+1,
+                                 IS_CONN_ENCRYPTED(req->conn)
+                                 ||req->encrypted, &req->pcd)) {
+                       exit_server_cleanly("api_dcerpc_cmd_read_done: "
+                                           "srv_send_smb failed.");
+               }
+               TALLOC_FREE(req);
+               return;
+       }
+
+       send_trans_reply(req->conn, req, NULL, 0, (char *)state->data, nread,
+                        is_data_outstanding);
+       TALLOC_FREE(req);
 }
 
 /****************************************************************************
  WaitNamedPipeHandleState 
 ****************************************************************************/
 
-static void api_WNPHS(connection_struct *conn, struct smb_request *req, smb_np_struct *p,
-                     char *param, int param_len)
+static void api_WNPHS(connection_struct *conn, struct smb_request *req,
+                     struct files_struct *fsp, char *param, int param_len)
 {
-       uint16 priority;
-
        if (!param || param_len < 2) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                return;
        }
 
-       priority = SVAL(param,0);
-       DEBUG(4,("WaitNamedPipeHandleState priority %x\n", priority));
+       DEBUG(4,("WaitNamedPipeHandleState priority %x\n",
+                (int)SVAL(param,0)));
 
-       if (wait_rpc_pipe_hnd_state(p, priority)) {
-               /* now send the reply */
-               send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
-               return;
-       }
-       api_no_reply(conn,req);
+       send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
 }
 
 
@@ -247,25 +383,17 @@ static void api_WNPHS(connection_struct *conn, struct smb_request *req, smb_np_s
  SetNamedPipeHandleState 
 ****************************************************************************/
 
-static void api_SNPHS(connection_struct *conn, struct smb_request *req, smb_np_struct *p,
-                     char *param, int param_len)
+static void api_SNPHS(connection_struct *conn, struct smb_request *req,
+                     struct files_struct *fsp, char *param, int param_len)
 {
-       uint16 id;
-
        if (!param || param_len < 2) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                return;
        }
 
-       id = SVAL(param,0);
-       DEBUG(4,("SetNamedPipeHandleState to code %x\n", id));
+       DEBUG(4,("SetNamedPipeHandleState to code %x\n", (int)SVAL(param,0)));
 
-       if (set_rpc_pipe_hnd_state(p, id)) {
-               /* now send the reply */
-               send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
-               return;
-       }
-       api_no_reply(conn,req);
+       send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
 }
 
 
@@ -295,12 +423,11 @@ static void api_no_reply(connection_struct *conn, struct smb_request *req)
 
 static void api_fd_reply(connection_struct *conn, uint16 vuid,
                         struct smb_request *req,
-                        uint16 *setup, char *data, char *params,
+                        uint16 *setup, uint8_t *data, char *params,
                         int suwcnt, int tdscnt, int tpscnt,
                         int mdrcnt, int mprcnt)
 {
-       bool reply = False;
-       smb_np_struct *p = NULL;
+       struct files_struct *fsp;
        int pnum;
        int subcommand;
 
@@ -316,12 +443,14 @@ static void api_fd_reply(connection_struct *conn, uint16 vuid,
        /* Get the file handle and hence the file name. */
        /* 
         * NB. The setup array has already been transformed
-        * via SVAL and so is in gost byte order.
+        * via SVAL and so is in host byte order.
         */
        pnum = ((int)setup[1]) & 0xFFFF;
        subcommand = ((int)setup[0]) & 0xFFFF;
 
-       if(!(p = get_rpc_pipe(pnum))) {
+       fsp = file_fsp(req, pnum);
+
+       if (!fsp_is_np(fsp)) {
                if (subcommand == TRANSACT_WAITNAMEDPIPEHANDLESTATE) {
                        /* Win9x does this call with a unicode pipe name, not a pnum. */
                        /* Just return success for now... */
@@ -335,37 +464,32 @@ static void api_fd_reply(connection_struct *conn, uint16 vuid,
                return;
        }
 
-       if (vuid != p->vuid) {
+       if (vuid != fsp->vuid) {
                DEBUG(1, ("Got pipe request (pnum %x) using invalid VUID %d, "
-                         "expected %d\n", pnum, vuid, p->vuid));
+                         "expected %d\n", pnum, vuid, fsp->vuid));
                reply_nterror(req, NT_STATUS_INVALID_HANDLE);
                return;
        }
 
-       DEBUG(3,("Got API command 0x%x on pipe \"%s\" (pnum %x)\n", subcommand, p->name, pnum));
+       DEBUG(3,("Got API command 0x%x on pipe \"%s\" (pnum %x)\n",
+                subcommand, fsp_str_dbg(fsp), pnum));
 
-       /* record maximum data length that can be transmitted in an SMBtrans */
-       p->max_trans_reply = mdrcnt;
-
-       DEBUG(10,("api_fd_reply: p:%p max_trans_reply: %d\n", p, p->max_trans_reply));
+       DEBUG(10, ("api_fd_reply: p:%p max_trans_reply: %d\n", fsp, mdrcnt));
 
        switch (subcommand) {
-       case TRANSACT_DCERPCCMD:
+       case TRANSACT_DCERPCCMD: {
                /* dce/rpc command */
-               reply = write_to_pipe(p, data, tdscnt);
-               if (!reply) {
-                       api_no_reply(conn, req);
-                       return;
-               }
-               api_rpc_trans_reply(conn, req, p);
+               api_dcerpc_cmd(conn, req, fsp, (uint8_t *)data, tdscnt,
+                              mdrcnt);
                break;
+       }
        case TRANSACT_WAITNAMEDPIPEHANDLESTATE:
                /* Wait Named Pipe Handle state */
-               api_WNPHS(conn, req, p, params, tpscnt);
+               api_WNPHS(conn, req, fsp, params, tpscnt);
                break;
        case TRANSACT_SETNAMEDPIPEHANDLESTATE:
                /* Set Named Pipe Handle state */
-               api_SNPHS(conn, req, p, params, tpscnt);
+               api_SNPHS(conn, req, fsp, params, tpscnt);
                break;
        default:
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -403,7 +527,7 @@ static void named_pipe(connection_struct *conn, uint16 vuid,
                DEBUG(4,("named pipe command from Win95 (wow!)\n"));
 
                api_fd_reply(conn, vuid, req,
-                            setup, data, params,
+                            setup, (uint8_t *)data, params,
                             suwcnt, tdscnt, tpscnt,
                             mdrcnt, mprcnt);
                return;
@@ -411,7 +535,7 @@ static void named_pipe(connection_struct *conn, uint16 vuid,
 
        if (strlen(name) < 1) {
                api_fd_reply(conn, vuid, req,
-                            setup, data,
+                            setup, (uint8_t *)data,
                             params, suwcnt, tdscnt,
                             tpscnt, mdrcnt, mprcnt);
                return;
@@ -498,7 +622,6 @@ void reply_trans(struct smb_request *req)
        unsigned int pscnt;
        struct trans_state *state;
        NTSTATUS result;
-       int size;
 
        START_PROFILE(SMBtrans);
 
@@ -508,11 +631,10 @@ void reply_trans(struct smb_request *req)
                return;
        }
 
-       size = smb_len(req->inbuf) + 4;
-       dsoff = SVAL(req->inbuf, smb_dsoff);
-       dscnt = SVAL(req->inbuf, smb_dscnt);
-       psoff = SVAL(req->inbuf, smb_psoff);
-       pscnt = SVAL(req->inbuf, smb_pscnt);
+       dsoff = SVAL(req->vwv+12, 0);
+       dscnt = SVAL(req->vwv+11, 0);
+       psoff = SVAL(req->vwv+10, 0);
+       pscnt = SVAL(req->vwv+9, 0);
 
        result = allow_new_trans(conn->pending_trans, req->mid);
        if (!NT_STATUS_IS_OK(result)) {
@@ -523,7 +645,7 @@ void reply_trans(struct smb_request *req)
                return;
        }
 
-       if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
+       if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
                DEBUG(0, ("talloc failed\n"));
                reply_nterror(req, NT_STATUS_NO_MEMORY);
                END_PROFILE(SMBtrans);
@@ -534,26 +656,32 @@ void reply_trans(struct smb_request *req)
 
        state->mid = req->mid;
        state->vuid = req->vuid;
-       state->setup_count = CVAL(req->inbuf, smb_suwcnt);
+       state->setup_count = CVAL(req->vwv+13, 0);
        state->setup = NULL;
-       state->total_param = SVAL(req->inbuf, smb_tpscnt);
+       state->total_param = SVAL(req->vwv+0, 0);
        state->param = NULL;
-       state->total_data = SVAL(req->inbuf, smb_tdscnt);
+       state->total_data = SVAL(req->vwv+1, 0);
        state->data = NULL;
-       state->max_param_return = SVAL(req->inbuf, smb_mprcnt);
-       state->max_data_return = SVAL(req->inbuf, smb_mdrcnt);
-       state->max_setup_return = CVAL(req->inbuf, smb_msrcnt);
-       state->close_on_completion = BITSETW(req->inbuf+smb_vwv5,0);
-       state->one_way = BITSETW(req->inbuf+smb_vwv5,1);
+       state->max_param_return = SVAL(req->vwv+2, 0);
+       state->max_data_return = SVAL(req->vwv+3, 0);
+       state->max_setup_return = CVAL(req->vwv+4, 0);
+       state->close_on_completion = BITSETW(req->vwv+5, 0);
+       state->one_way = BITSETW(req->vwv+5, 1);
 
-       srvstr_pull_buf_talloc(state, req->inbuf, req->flags2, &state->name,
-                       smb_buf(req->inbuf), STR_TERMINATE);
+       srvstr_pull_req_talloc(state, req, &state->name, req->buf,
+                              STR_TERMINATE);
 
        if ((dscnt > state->total_data) || (pscnt > state->total_param) ||
                        !state->name)
                goto bad_param;
 
        if (state->total_data)  {
+
+               if (trans_oob(state->total_data, 0, dscnt)
+                   || trans_oob(smb_len(req->inbuf), dsoff, dscnt)) {
+                       goto bad_param;
+               }
+
                /* Can't use talloc here, the core routines do realloc on the
                 * params and data. Out of paranoia, 100 bytes too many. */
                state->data = (char *)SMB_MALLOC(state->total_data+100);
@@ -567,17 +695,17 @@ void reply_trans(struct smb_request *req)
                }
                /* null-terminate the slack space */
                memset(&state->data[state->total_data], 0, 100);
-               if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
-                       goto bad_param;
-               if ((smb_base(req->inbuf)+dsoff+dscnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf)+dsoff+dscnt < smb_base(req->inbuf)))
-                       goto bad_param;
 
                memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
        }
 
        if (state->total_param) {
+
+               if (trans_oob(state->total_param, 0, pscnt)
+                   || trans_oob(smb_len(req->inbuf), psoff, pscnt)) {
+                       goto bad_param;
+               }
+
                /* Can't use talloc here, the core routines do realloc on the
                 * params and data. Out of paranoia, 100 bytes too many */
                state->param = (char *)SMB_MALLOC(state->total_param+100);
@@ -592,12 +720,6 @@ void reply_trans(struct smb_request *req)
                } 
                /* null-terminate the slack space */
                memset(&state->param[state->total_param], 0, 100);
-               if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
-                       goto bad_param;
-               if ((smb_base(req->inbuf)+psoff+pscnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf)+psoff+pscnt < smb_base(req->inbuf)))
-                       goto bad_param;
 
                memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
        }
@@ -607,7 +729,20 @@ void reply_trans(struct smb_request *req)
 
        if (state->setup_count) {
                unsigned int i;
-               if((state->setup = TALLOC_ARRAY(
+
+               /*
+                * No overflow possible here, state->setup_count is an
+                * unsigned int, being filled by a single byte from
+                * CVAL(req->vwv+13, 0) above. The cast in the comparison
+                * below is not necessary, it's here to clarify things. The
+                * validity of req->vwv and req->wct has been checked in
+                * init_smb_request already.
+                */
+               if (state->setup_count + 14 > (unsigned int)req->wct) {
+                       goto bad_param;
+               }
+
+               if((state->setup = talloc_array(
                            state, uint16, state->setup_count)) == NULL) {
                        DEBUG(0,("reply_trans: setup malloc fail for %u "
                                 "bytes !\n", (unsigned int)
@@ -619,17 +754,10 @@ void reply_trans(struct smb_request *req)
                        END_PROFILE(SMBtrans);
                        return;
                } 
-               if (req->inbuf+smb_vwv14+(state->setup_count*SIZEOFWORD) >
-                   req->inbuf + size)
-                       goto bad_param;
-               if ((smb_vwv14+(state->setup_count*SIZEOFWORD) < smb_vwv14) ||
-                   (smb_vwv14+(state->setup_count*SIZEOFWORD) <
-                    (state->setup_count*SIZEOFWORD)))
-                       goto bad_param;
 
-               for (i=0;i<state->setup_count;i++)
-                       state->setup[i] = SVAL(req->inbuf,
-                                              smb_vwv14+i*SIZEOFWORD);
+               for (i=0;i<state->setup_count;i++) {
+                       state->setup[i] = SVAL(req->vwv + 14 + i, 0);
+               }
        }
 
        state->received_param = pscnt;
@@ -646,6 +774,8 @@ void reply_trans(struct smb_request *req)
                return;
        }
 
+       talloc_steal(talloc_tos(), state);
+
        handle_trans(conn, req, state);
 
        SAFE_FREE(state->data);
@@ -675,11 +805,10 @@ void reply_transs(struct smb_request *req)
        connection_struct *conn = req->conn;
        unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
        struct trans_state *state;
-       int size;
 
        START_PROFILE(SMBtranss);
 
-       show_msg((char *)req->inbuf);
+       show_msg((const char *)req->inbuf);
 
        if (req->wct < 8) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -703,64 +832,40 @@ void reply_transs(struct smb_request *req)
        /* Revise total_params and total_data in case they have changed
         * downwards */
 
-       if (SVAL(req->inbuf, smb_vwv0) < state->total_param)
-               state->total_param = SVAL(req->inbuf,smb_vwv0);
-       if (SVAL(req->inbuf, smb_vwv1) < state->total_data)
-               state->total_data = SVAL(req->inbuf,smb_vwv1);
+       if (SVAL(req->vwv+0, 0) < state->total_param)
+               state->total_param = SVAL(req->vwv+0, 0);
+       if (SVAL(req->vwv+1, 0) < state->total_data)
+               state->total_data = SVAL(req->vwv+1, 0);
 
-       size = smb_len(req->inbuf) + 4;
+       pcnt = SVAL(req->vwv+2, 0);
+       poff = SVAL(req->vwv+3, 0);
+       pdisp = SVAL(req->vwv+4, 0);
 
-       pcnt = SVAL(req->inbuf, smb_spscnt);
-       poff = SVAL(req->inbuf, smb_spsoff);
-       pdisp = SVAL(req->inbuf, smb_spsdisp);
-
-       dcnt = SVAL(req->inbuf, smb_sdscnt);
-       doff = SVAL(req->inbuf, smb_sdsoff);
-       ddisp = SVAL(req->inbuf, smb_sdsdisp);
+       dcnt = SVAL(req->vwv+5, 0);
+       doff = SVAL(req->vwv+6, 0);
+       ddisp = SVAL(req->vwv+7, 0);
 
        state->received_param += pcnt;
        state->received_data += dcnt;
-               
+
        if ((state->received_data > state->total_data) ||
            (state->received_param > state->total_param))
                goto bad_param;
-               
+
        if (pcnt) {
-               if (pdisp+pcnt > state->total_param)
+               if (trans_oob(state->total_param, pdisp, pcnt)
+                   || trans_oob(smb_len(req->inbuf), poff, pcnt)) {
                        goto bad_param;
-               if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
-                       goto bad_param;
-               if (pdisp > state->total_param)
-                       goto bad_param;
-               if ((smb_base(req->inbuf) + poff + pcnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf) + poff + pcnt
-                    < smb_base(req->inbuf)))
-                       goto bad_param;
-               if (state->param + pdisp < state->param)
-                       goto bad_param;
-
-               memcpy(state->param+pdisp,smb_base(req->inbuf)+poff,
-                      pcnt);
+               }
+               memcpy(state->param+pdisp,smb_base(req->inbuf)+poff,pcnt);
        }
 
        if (dcnt) {
-               if (ddisp+dcnt > state->total_data)
+               if (trans_oob(state->total_data, ddisp, dcnt)
+                   || trans_oob(smb_len(req->inbuf), doff, dcnt)) {
                        goto bad_param;
-               if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
-                       goto bad_param;
-               if (ddisp > state->total_data)
-                       goto bad_param;
-               if ((smb_base(req->inbuf) + doff + dcnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf) + doff + dcnt
-                    < smb_base(req->inbuf)))
-                       goto bad_param;
-               if (state->data + ddisp < state->data)
-                       goto bad_param;
-
-               memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
-                      dcnt);
+               }
+               memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
        }
 
        if ((state->received_param < state->total_param) ||
@@ -769,11 +874,7 @@ void reply_transs(struct smb_request *req)
                return;
        }
 
-        /*
-        * construct_reply_common will copy smb_com from inbuf to
-        * outbuf. SMBtranss is wrong here.
-         */
-        SCVAL(req->inbuf,smb_com,SMBtrans);
+       talloc_steal(talloc_tos(), state);
 
        handle_trans(conn, req, state);