s3-talloc Change TALLOC_ARRAY() to talloc_array()
[samba.git] / source3 / smbd / ipc.c
index d11c8c7cd51fecdf1779ed518865f825b4d779b0..b452000e13921ddbac3689d39d32cfaacf28d5b9 100644 (file)
    */
 
 #include "includes.h"
-
-extern int max_send;
+#include "smbd/smbd.h"
+#include "smbd/globals.h"
+#include "smbprofile.h"
+#include "rpc_server/srv_pipe_hnd.h"
 
 #define NERR_notsupported 50
 
@@ -81,7 +83,8 @@ static void copy_trans_params_and_data(char *outbuf, int align,
  Send a trans reply.
  ****************************************************************************/
 
-void send_trans_reply(connection_struct *conn, const uint8_t *inbuf,
+void send_trans_reply(connection_struct *conn,
+                     struct smb_request *req,
                      char *rparam, int rparam_len,
                      char *rdata, int rdata_len,
                      bool buffer_too_large)
@@ -90,10 +93,11 @@ void send_trans_reply(connection_struct *conn, const uint8_t *inbuf,
        int tot_data_sent = 0;
        int tot_param_sent = 0;
        int align;
-       char *outbuf;
 
        int ldata  = rdata  ? rdata_len : 0;
        int lparam = rparam ? rparam_len : 0;
+       struct smbd_server_connection *sconn = req->sconn;
+       int max_send = sconn->smb1.sessions.max_send;
 
        if (buffer_too_large)
                DEBUG(5,("send_trans_reply: buffer %d too large\n", ldata ));
@@ -103,38 +107,44 @@ void send_trans_reply(connection_struct *conn, const uint8_t *inbuf,
 
        align = ((this_lparam)%4);
 
-       if (!create_outbuf(talloc_tos(), (char *)inbuf, &outbuf,
-                          10, 1+align+this_ldata+this_lparam)) {
-               smb_panic("could not allocate outbuf");
-       }
+       reply_outbuf(req, 10, 1+align+this_ldata+this_lparam);
+
+       /*
+        * We might have SMBtranss in req which was transferred to the outbuf,
+        * fix that.
+        */
+       SCVAL(req->outbuf, smb_com, SMBtrans);
 
-       copy_trans_params_and_data(outbuf, align,
+       copy_trans_params_and_data((char *)req->outbuf, align,
                                rparam, tot_param_sent, this_lparam,
                                rdata, tot_data_sent, this_ldata);
 
-       SSVAL(outbuf,smb_vwv0,lparam);
-       SSVAL(outbuf,smb_vwv1,ldata);
-       SSVAL(outbuf,smb_vwv3,this_lparam);
-       SSVAL(outbuf,smb_vwv4,smb_offset(smb_buf(outbuf)+1,outbuf));
-       SSVAL(outbuf,smb_vwv5,0);
-       SSVAL(outbuf,smb_vwv6,this_ldata);
-       SSVAL(outbuf,smb_vwv7,smb_offset(smb_buf(outbuf)+1+this_lparam+align,
-                                        outbuf));
-       SSVAL(outbuf,smb_vwv8,0);
-       SSVAL(outbuf,smb_vwv9,0);
+       SSVAL(req->outbuf,smb_vwv0,lparam);
+       SSVAL(req->outbuf,smb_vwv1,ldata);
+       SSVAL(req->outbuf,smb_vwv3,this_lparam);
+       SSVAL(req->outbuf,smb_vwv4,
+             smb_offset(smb_buf(req->outbuf)+1, req->outbuf));
+       SSVAL(req->outbuf,smb_vwv5,0);
+       SSVAL(req->outbuf,smb_vwv6,this_ldata);
+       SSVAL(req->outbuf,smb_vwv7,
+             smb_offset(smb_buf(req->outbuf)+1+this_lparam+align,
+                        req->outbuf));
+       SSVAL(req->outbuf,smb_vwv8,0);
+       SSVAL(req->outbuf,smb_vwv9,0);
 
        if (buffer_too_large) {
-               error_packet_set((char *)outbuf, ERRDOS, ERRmoredata,
+               error_packet_set((char *)req->outbuf, ERRDOS, ERRmoredata,
                                 STATUS_BUFFER_OVERFLOW, __LINE__, __FILE__);
        }
 
-       show_msg(outbuf);
-       if (!srv_send_smb(smbd_server_fd(), (char *)outbuf,
-                         IS_CONN_ENCRYPTED(conn))) {
+       show_msg((char *)req->outbuf);
+       if (!srv_send_smb(sconn, (char *)req->outbuf,
+                         true, req->seqnum+1,
+                         IS_CONN_ENCRYPTED(conn), &req->pcd)) {
                exit_server_cleanly("send_trans_reply: srv_send_smb failed.");
        }
 
-       TALLOC_FREE(outbuf);
+       TALLOC_FREE(req->outbuf);
 
        tot_data_sent = this_ldata;
        tot_param_sent = this_lparam;
@@ -154,39 +164,49 @@ void send_trans_reply(connection_struct *conn, const uint8_t *inbuf,
 
                align = (this_lparam%4);
 
-               if (!create_outbuf(talloc_tos(), (char *)inbuf, &outbuf,
-                                  10, 1+align+this_ldata+this_lparam)) {
-                       smb_panic("could not allocate outbuf");
-               }
+               reply_outbuf(req, 10, 1+align+this_ldata+this_lparam);
 
-               copy_trans_params_and_data(outbuf, align,
+               /*
+                * We might have SMBtranss in req which was transferred to the
+                * outbuf, fix that.
+                */
+               SCVAL(req->outbuf, smb_com, SMBtrans);
+
+               copy_trans_params_and_data((char *)req->outbuf, align,
                                           rparam, tot_param_sent, this_lparam,
                                           rdata, tot_data_sent, this_ldata);
 
-               SSVAL(outbuf,smb_vwv3,this_lparam);
-               SSVAL(outbuf,smb_vwv4,smb_offset(smb_buf(outbuf)+1,outbuf));
-               SSVAL(outbuf,smb_vwv5,tot_param_sent);
-               SSVAL(outbuf,smb_vwv6,this_ldata);
-               SSVAL(outbuf,smb_vwv7,
-                     smb_offset(smb_buf(outbuf)+1+this_lparam+align, outbuf));
-               SSVAL(outbuf,smb_vwv8,tot_data_sent);
-               SSVAL(outbuf,smb_vwv9,0);
+               SSVAL(req->outbuf,smb_vwv0,lparam);
+               SSVAL(req->outbuf,smb_vwv1,ldata);
+
+               SSVAL(req->outbuf,smb_vwv3,this_lparam);
+               SSVAL(req->outbuf,smb_vwv4,
+                     smb_offset(smb_buf(req->outbuf)+1,req->outbuf));
+               SSVAL(req->outbuf,smb_vwv5,tot_param_sent);
+               SSVAL(req->outbuf,smb_vwv6,this_ldata);
+               SSVAL(req->outbuf,smb_vwv7,
+                     smb_offset(smb_buf(req->outbuf)+1+this_lparam+align,
+                                req->outbuf));
+               SSVAL(req->outbuf,smb_vwv8,tot_data_sent);
+               SSVAL(req->outbuf,smb_vwv9,0);
 
                if (buffer_too_large) {
-                       error_packet_set(outbuf, ERRDOS, ERRmoredata,
+                       error_packet_set((char *)req->outbuf,
+                                        ERRDOS, ERRmoredata,
                                         STATUS_BUFFER_OVERFLOW,
                                         __LINE__, __FILE__);
                }
 
-               show_msg(outbuf);
-               if (!srv_send_smb(smbd_server_fd(), outbuf,
-                                 IS_CONN_ENCRYPTED(conn)))
+               show_msg((char *)req->outbuf);
+               if (!srv_send_smb(sconn, (char *)req->outbuf,
+                                 true, req->seqnum+1,
+                                 IS_CONN_ENCRYPTED(conn), &req->pcd))
                        exit_server_cleanly("send_trans_reply: srv_send_smb "
                                            "failed.");
 
                tot_data_sent  += this_ldata;
                tot_param_sent += this_lparam;
-               TALLOC_FREE(outbuf);
+               TALLOC_FREE(req->outbuf);
        }
 }
 
@@ -194,34 +214,150 @@ void send_trans_reply(connection_struct *conn, const uint8_t *inbuf,
  Start the first part of an RPC reply which began with an SMBtrans request.
 ****************************************************************************/
 
-static void api_rpc_trans_reply(connection_struct *conn,
-                               struct smb_request *req,
-                               files_struct *fsp,
-                               int max_trans_reply)
+struct dcerpc_cmd_state {
+       struct fake_file_handle *handle;
+       uint8_t *data;
+       size_t num_data;
+       size_t max_read;
+};
+
+static void api_dcerpc_cmd_write_done(struct tevent_req *subreq);
+static void api_dcerpc_cmd_read_done(struct tevent_req *subreq);
+
+static void api_dcerpc_cmd(connection_struct *conn, struct smb_request *req,
+                          files_struct *fsp, uint8_t *data, size_t length,
+                          size_t max_read)
 {
-       bool is_data_outstanding;
-       uint8_t *rdata = SMB_MALLOC_ARRAY(uint8_t, max_trans_reply);
-       ssize_t data_len;
-       NTSTATUS status;
+       struct tevent_req *subreq;
+       struct dcerpc_cmd_state *state;
+       bool busy;
+
+       if (!fsp_is_np(fsp)) {
+               api_no_reply(conn, req);
+               return;
+       }
+
+       /*
+        * Trans requests are only allowed
+        * if no other Trans or Read is active
+        */
+       busy = np_read_in_progress(fsp->fake_file_handle);
+       if (busy) {
+               reply_nterror(req, NT_STATUS_PIPE_BUSY);
+               return;
+       }
+
+       state = talloc(req, struct dcerpc_cmd_state);
+       if (state == NULL) {
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               return;
+       }
+       req->async_priv = state;
+
+       state->handle = fsp->fake_file_handle;
+
+       /*
+        * This memdup severely sucks. But doing it properly essentially means
+        * to rewrite lanman.c, something which I don't really want to do now.
+        */
+       state->data = (uint8_t *)talloc_memdup(state, data, length);
+       if (state->data == NULL) {
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               return;
+       }
+       state->num_data = length;
+       state->max_read = max_read;
 
-       if(rdata == NULL) {
-               DEBUG(0,("api_rpc_trans_reply: malloc fail.\n"));
+       subreq = np_write_send(state, server_event_context(), state->handle,
+                              state->data, length);
+       if (subreq == NULL) {
+               TALLOC_FREE(state);
                reply_nterror(req, NT_STATUS_NO_MEMORY);
                return;
        }
+       tevent_req_set_callback(subreq, api_dcerpc_cmd_write_done,
+                               talloc_move(conn, &req));
+}
+
+static void api_dcerpc_cmd_write_done(struct tevent_req *subreq)
+{
+       struct smb_request *req = tevent_req_callback_data(
+               subreq, struct smb_request);
+       struct dcerpc_cmd_state *state = talloc_get_type_abort(
+               req->async_priv, struct dcerpc_cmd_state);
+       NTSTATUS status;
+       ssize_t nwritten = -1;
+
+       status = np_write_recv(subreq, &nwritten);
+       TALLOC_FREE(subreq);
+       if (!NT_STATUS_IS_OK(status) || (nwritten != state->num_data)) {
+               DEBUG(10, ("Could not write to pipe: %s (%d/%d)\n",
+                          nt_errstr(status), (int)state->num_data,
+                          (int)nwritten));
+               reply_nterror(req, NT_STATUS_PIPE_NOT_AVAILABLE);
+               goto send;
+       }
+
+       state->data = talloc_realloc(state, state->data, uint8_t,
+                                          state->max_read);
+       if (state->data == NULL) {
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               goto send;
+       }
+
+       subreq = np_read_send(req->conn, server_event_context(),
+                             state->handle, state->data, state->max_read);
+       if (subreq == NULL) {
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               goto send;
+       }
+       tevent_req_set_callback(subreq, api_dcerpc_cmd_read_done, req);
+       return;
+
+ send:
+       if (!srv_send_smb(
+                   req->sconn, (char *)req->outbuf,
+                   true, req->seqnum+1,
+                   IS_CONN_ENCRYPTED(req->conn) || req->encrypted,
+                   &req->pcd)) {
+               exit_server_cleanly("api_dcerpc_cmd_write_done: "
+                                   "srv_send_smb failed.");
+       }
+       TALLOC_FREE(req);
+}
+
+static void api_dcerpc_cmd_read_done(struct tevent_req *subreq)
+{
+       struct smb_request *req = tevent_req_callback_data(
+               subreq, struct smb_request);
+       struct dcerpc_cmd_state *state = talloc_get_type_abort(
+               req->async_priv, struct dcerpc_cmd_state);
+       NTSTATUS status;
+       ssize_t nread;
+       bool is_data_outstanding;
+
+       status = np_read_recv(subreq, &nread, &is_data_outstanding);
+       TALLOC_FREE(subreq);
 
-       status = np_read(fsp, rdata, max_trans_reply, &data_len,
-                        &is_data_outstanding);
        if (!NT_STATUS_IS_OK(status)) {
-               SAFE_FREE(rdata);
-               api_no_reply(conn,req);
+               DEBUG(10, ("Could not read from to pipe: %s\n",
+                          nt_errstr(status)));
+               reply_nterror(req, status);
+
+               if (!srv_send_smb(req->sconn, (char *)req->outbuf,
+                                 true, req->seqnum+1,
+                                 IS_CONN_ENCRYPTED(req->conn)
+                                 ||req->encrypted, &req->pcd)) {
+                       exit_server_cleanly("api_dcerpc_cmd_read_done: "
+                                           "srv_send_smb failed.");
+               }
+               TALLOC_FREE(req);
                return;
        }
 
-       send_trans_reply(conn, req->inbuf, NULL, 0, (char *)rdata, data_len,
+       send_trans_reply(req->conn, req, NULL, 0, (char *)state->data, nread,
                         is_data_outstanding);
-       SAFE_FREE(rdata);
-       return;
+       TALLOC_FREE(req);
 }
 
 /****************************************************************************
@@ -239,7 +375,7 @@ static void api_WNPHS(connection_struct *conn, struct smb_request *req,
        DEBUG(4,("WaitNamedPipeHandleState priority %x\n",
                 (int)SVAL(param,0)));
 
-       send_trans_reply(conn, req->inbuf, NULL, 0, NULL, 0, False);
+       send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
 }
 
 
@@ -257,7 +393,7 @@ static void api_SNPHS(connection_struct *conn, struct smb_request *req,
 
        DEBUG(4,("SetNamedPipeHandleState to code %x\n", (int)SVAL(param,0)));
 
-       send_trans_reply(conn, req->inbuf, NULL, 0, NULL, 0, False);
+       send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
 }
 
 
@@ -276,7 +412,7 @@ static void api_no_reply(connection_struct *conn, struct smb_request *req)
        DEBUG(3,("Unsupported API fd command\n"));
 
        /* now send the reply */
-       send_trans_reply(conn, req->inbuf, rparam, 4, NULL, 0, False);
+       send_trans_reply(conn, req, rparam, 4, NULL, 0, False);
 
        return;
 }
@@ -294,7 +430,6 @@ static void api_fd_reply(connection_struct *conn, uint16 vuid,
        struct files_struct *fsp;
        int pnum;
        int subcommand;
-       NTSTATUS status;
 
        DEBUG(5,("api_fd_reply\n"));
 
@@ -320,8 +455,7 @@ static void api_fd_reply(connection_struct *conn, uint16 vuid,
                        /* Win9x does this call with a unicode pipe name, not a pnum. */
                        /* Just return success for now... */
                        DEBUG(3,("Got TRANSACT_WAITNAMEDPIPEHANDLESTATE on text pipe name\n"));
-                       send_trans_reply(conn, req->inbuf, NULL, 0, NULL, 0,
-                                        False);
+                       send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
                        return;
                }
 
@@ -338,20 +472,15 @@ static void api_fd_reply(connection_struct *conn, uint16 vuid,
        }
 
        DEBUG(3,("Got API command 0x%x on pipe \"%s\" (pnum %x)\n",
-                subcommand, fsp->fsp_name, pnum));
+                subcommand, fsp_str_dbg(fsp), pnum));
 
        DEBUG(10, ("api_fd_reply: p:%p max_trans_reply: %d\n", fsp, mdrcnt));
 
        switch (subcommand) {
        case TRANSACT_DCERPCCMD: {
                /* dce/rpc command */
-               ssize_t nwritten;
-               status = np_write(fsp, data, tdscnt, &nwritten);
-               if (!NT_STATUS_IS_OK(status)) {
-                       api_no_reply(conn, req);
-                       return;
-               }
-               api_rpc_trans_reply(conn, req, fsp, mdrcnt);
+               api_dcerpc_cmd(conn, req, fsp, (uint8_t *)data, tdscnt,
+                              mdrcnt);
                break;
        }
        case TRANSACT_WAITNAMEDPIPEHANDLESTATE:
@@ -493,8 +622,6 @@ void reply_trans(struct smb_request *req)
        unsigned int pscnt;
        struct trans_state *state;
        NTSTATUS result;
-       unsigned int size;
-       unsigned int av_size;
 
        START_PROFILE(SMBtrans);
 
@@ -504,12 +631,10 @@ void reply_trans(struct smb_request *req)
                return;
        }
 
-       size = smb_len(req->inbuf) + 4;
-       av_size = smb_len(req->inbuf);
-       dsoff = SVAL(req->inbuf, smb_dsoff);
-       dscnt = SVAL(req->inbuf, smb_dscnt);
-       psoff = SVAL(req->inbuf, smb_psoff);
-       pscnt = SVAL(req->inbuf, smb_pscnt);
+       dsoff = SVAL(req->vwv+12, 0);
+       dscnt = SVAL(req->vwv+11, 0);
+       psoff = SVAL(req->vwv+10, 0);
+       pscnt = SVAL(req->vwv+9, 0);
 
        result = allow_new_trans(conn->pending_trans, req->mid);
        if (!NT_STATUS_IS_OK(result)) {
@@ -531,26 +656,32 @@ void reply_trans(struct smb_request *req)
 
        state->mid = req->mid;
        state->vuid = req->vuid;
-       state->setup_count = CVAL(req->inbuf, smb_suwcnt);
+       state->setup_count = CVAL(req->vwv+13, 0);
        state->setup = NULL;
-       state->total_param = SVAL(req->inbuf, smb_tpscnt);
+       state->total_param = SVAL(req->vwv+0, 0);
        state->param = NULL;
-       state->total_data = SVAL(req->inbuf, smb_tdscnt);
+       state->total_data = SVAL(req->vwv+1, 0);
        state->data = NULL;
-       state->max_param_return = SVAL(req->inbuf, smb_mprcnt);
-       state->max_data_return = SVAL(req->inbuf, smb_mdrcnt);
-       state->max_setup_return = CVAL(req->inbuf, smb_msrcnt);
-       state->close_on_completion = BITSETW(req->inbuf+smb_vwv5,0);
-       state->one_way = BITSETW(req->inbuf+smb_vwv5,1);
+       state->max_param_return = SVAL(req->vwv+2, 0);
+       state->max_data_return = SVAL(req->vwv+3, 0);
+       state->max_setup_return = CVAL(req->vwv+4, 0);
+       state->close_on_completion = BITSETW(req->vwv+5, 0);
+       state->one_way = BITSETW(req->vwv+5, 1);
 
-       srvstr_pull_buf_talloc(state, req->inbuf, req->flags2, &state->name,
-                              req->buf, STR_TERMINATE);
+       srvstr_pull_req_talloc(state, req, &state->name, req->buf,
+                              STR_TERMINATE);
 
        if ((dscnt > state->total_data) || (pscnt > state->total_param) ||
                        !state->name)
                goto bad_param;
 
        if (state->total_data)  {
+
+               if (trans_oob(state->total_data, 0, dscnt)
+                   || trans_oob(smb_len(req->inbuf), dsoff, dscnt)) {
+                       goto bad_param;
+               }
+
                /* Can't use talloc here, the core routines do realloc on the
                 * params and data. Out of paranoia, 100 bytes too many. */
                state->data = (char *)SMB_MALLOC(state->total_data+100);
@@ -565,21 +696,16 @@ void reply_trans(struct smb_request *req)
                /* null-terminate the slack space */
                memset(&state->data[state->total_data], 0, 100);
 
-               if (dscnt > state->total_data ||
-                               dsoff+dscnt < dsoff) {
-                       goto bad_param;
-               }
-
-               if (dsoff > av_size ||
-                               dscnt > av_size ||
-                               dsoff+dscnt > av_size) {
-                       goto bad_param;
-               }
-
                memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
        }
 
        if (state->total_param) {
+
+               if (trans_oob(state->total_param, 0, pscnt)
+                   || trans_oob(smb_len(req->inbuf), psoff, pscnt)) {
+                       goto bad_param;
+               }
+
                /* Can't use talloc here, the core routines do realloc on the
                 * params and data. Out of paranoia, 100 bytes too many */
                state->param = (char *)SMB_MALLOC(state->total_param+100);
@@ -595,17 +721,6 @@ void reply_trans(struct smb_request *req)
                /* null-terminate the slack space */
                memset(&state->param[state->total_param], 0, 100);
 
-               if (pscnt > state->total_param ||
-                               psoff+pscnt < psoff) {
-                       goto bad_param;
-               }
-
-               if (psoff > av_size ||
-                               pscnt > av_size ||
-                               psoff+pscnt > av_size) {
-                       goto bad_param;
-               }
-
                memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
        }
 
@@ -614,7 +729,20 @@ void reply_trans(struct smb_request *req)
 
        if (state->setup_count) {
                unsigned int i;
-               if((state->setup = TALLOC_ARRAY(
+
+               /*
+                * No overflow possible here, state->setup_count is an
+                * unsigned int, being filled by a single byte from
+                * CVAL(req->vwv+13, 0) above. The cast in the comparison
+                * below is not necessary, it's here to clarify things. The
+                * validity of req->vwv and req->wct has been checked in
+                * init_smb_request already.
+                */
+               if (state->setup_count + 14 > (unsigned int)req->wct) {
+                       goto bad_param;
+               }
+
+               if((state->setup = talloc_array(
                            state, uint16, state->setup_count)) == NULL) {
                        DEBUG(0,("reply_trans: setup malloc fail for %u "
                                 "bytes !\n", (unsigned int)
@@ -626,17 +754,10 @@ void reply_trans(struct smb_request *req)
                        END_PROFILE(SMBtrans);
                        return;
                } 
-               if (req->inbuf+smb_vwv14+(state->setup_count*SIZEOFWORD) >
-                   req->inbuf + size)
-                       goto bad_param;
-               if ((smb_vwv14+(state->setup_count*SIZEOFWORD) < smb_vwv14) ||
-                   (smb_vwv14+(state->setup_count*SIZEOFWORD) <
-                    (state->setup_count*SIZEOFWORD)))
-                       goto bad_param;
 
-               for (i=0;i<state->setup_count;i++)
-                       state->setup[i] = SVAL(req->inbuf,
-                                              smb_vwv14+i*SIZEOFWORD);
+               for (i=0;i<state->setup_count;i++) {
+                       state->setup[i] = SVAL(req->vwv + 14 + i, 0);
+               }
        }
 
        state->received_param = pscnt;
@@ -653,6 +774,8 @@ void reply_trans(struct smb_request *req)
                return;
        }
 
+       talloc_steal(talloc_tos(), state);
+
        handle_trans(conn, req, state);
 
        SAFE_FREE(state->data);
@@ -682,11 +805,10 @@ void reply_transs(struct smb_request *req)
        connection_struct *conn = req->conn;
        unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
        struct trans_state *state;
-       unsigned int av_size;
 
        START_PROFILE(SMBtranss);
 
-       show_msg((char *)req->inbuf);
+       show_msg((const char *)req->inbuf);
 
        if (req->wct < 8) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -710,20 +832,18 @@ void reply_transs(struct smb_request *req)
        /* Revise total_params and total_data in case they have changed
         * downwards */
 
-       if (SVAL(req->inbuf, smb_vwv0) < state->total_param)
-               state->total_param = SVAL(req->inbuf,smb_vwv0);
-       if (SVAL(req->inbuf, smb_vwv1) < state->total_data)
-               state->total_data = SVAL(req->inbuf,smb_vwv1);
+       if (SVAL(req->vwv+0, 0) < state->total_param)
+               state->total_param = SVAL(req->vwv+0, 0);
+       if (SVAL(req->vwv+1, 0) < state->total_data)
+               state->total_data = SVAL(req->vwv+1, 0);
 
-       av_size = smb_len(req->inbuf);
+       pcnt = SVAL(req->vwv+2, 0);
+       poff = SVAL(req->vwv+3, 0);
+       pdisp = SVAL(req->vwv+4, 0);
 
-       pcnt = SVAL(req->inbuf, smb_spscnt);
-       poff = SVAL(req->inbuf, smb_spsoff);
-       pdisp = SVAL(req->inbuf, smb_spsdisp);
-
-       dcnt = SVAL(req->inbuf, smb_sdscnt);
-       doff = SVAL(req->inbuf, smb_sdsoff);
-       ddisp = SVAL(req->inbuf, smb_sdsdisp);
+       dcnt = SVAL(req->vwv+5, 0);
+       doff = SVAL(req->vwv+6, 0);
+       ddisp = SVAL(req->vwv+7, 0);
 
        state->received_param += pcnt;
        state->received_data += dcnt;
@@ -733,41 +853,19 @@ void reply_transs(struct smb_request *req)
                goto bad_param;
 
        if (pcnt) {
-               if (pdisp > state->total_param ||
-                               pcnt > state->total_param ||
-                               pdisp+pcnt > state->total_param ||
-                               pdisp+pcnt < pdisp) {
-                       goto bad_param;
-               }
-
-               if (poff > av_size ||
-                               pcnt > av_size ||
-                               poff+pcnt > av_size ||
-                               poff+pcnt < poff) {
+               if (trans_oob(state->total_param, pdisp, pcnt)
+                   || trans_oob(smb_len(req->inbuf), poff, pcnt)) {
                        goto bad_param;
                }
-
-               memcpy(state->param+pdisp,smb_base(req->inbuf)+poff,
-                      pcnt);
+               memcpy(state->param+pdisp,smb_base(req->inbuf)+poff,pcnt);
        }
 
        if (dcnt) {
-               if (ddisp > state->total_data ||
-                               dcnt > state->total_data ||
-                               ddisp+dcnt > state->total_data ||
-                               ddisp+dcnt < ddisp) {
-                       goto bad_param;
-               }
-
-               if (ddisp > av_size ||
-                               dcnt > av_size ||
-                               ddisp+dcnt > av_size ||
-                               ddisp+dcnt < ddisp) {
+               if (trans_oob(state->total_data, ddisp, dcnt)
+                   || trans_oob(smb_len(req->inbuf), doff, dcnt)) {
                        goto bad_param;
                }
-
-               memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
-                      dcnt);
+               memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
        }
 
        if ((state->received_param < state->total_param) ||
@@ -776,11 +874,7 @@ void reply_transs(struct smb_request *req)
                return;
        }
 
-        /*
-        * construct_reply_common will copy smb_com from inbuf to
-        * outbuf. SMBtranss is wrong here.
-         */
-        SCVAL(req->inbuf,smb_com,SMBtrans);
+       talloc_steal(talloc_tos(), state);
 
        handle_trans(conn, req, state);