s3: Fix stream marshalling to return the correct streaminfo status

When there are enough streams on a file to fill up the max_data_count
when responding to a trans2 streaminfo, samba is returning
NT_STATUS_BUFFER_TOO_SMALL.  Windows handles this by returning
NT_STATUS_BUFFER_OVERFLOW while still sending as much of the data that
it can fit into the buffer.  When the windows client sees
BUFFER_OVERFLOW, it retries the streaminfo with a larger buffer (2x).
The windows client starts at 2K and will continue increasing the
buffer size by two until it reaches 64K.  If the streams don't fit in
64K the windows client seems to give up.

This patch fixes marshall_stream_info to overfill the buffer by 1
stream so that send_trans2_replies can properly detect the overflow
and return the correct status.

diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index 27e29515e4801439de960608af3d7a3d35f5a2e0..1d724bafd8429533fa1e358ef84bd77f769265cd 100644 (file)
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -3687,7 +3687,7 @@ static NTSTATUS marshall_stream_info(unsigned int num_streams,
        unsigned int i;
        unsigned int ofs = 0;
 
-       for (i=0; i<num_streams; i++) {
+       for (i = 0; i < num_streams && ofs <= max_data_bytes; i++) {
                unsigned int next_offset;
                size_t namelen;
                smb_ucs2_t *namebuf;
@@ -3706,11 +3706,6 @@ static NTSTATUS marshall_stream_info(unsigned int num_streams,
 
                namelen -= 2;
 
-               if (ofs + 24 + namelen > max_data_bytes) {
-                       TALLOC_FREE(namebuf);
-                       return NT_STATUS_BUFFER_TOO_SMALL;
-               }
-
                SIVAL(data, ofs+4, namelen);
                SOFF_T(data, ofs+8, streams[i].size);
                SOFF_T(data, ofs+16, streams[i].alloc_size);
@@ -3725,10 +3720,6 @@ static NTSTATUS marshall_stream_info(unsigned int num_streams,
                else {
                        unsigned int align = ndr_align_size(next_offset, 8);
 
-                       if (next_offset + align > max_data_bytes) {
-                               return NT_STATUS_BUFFER_TOO_SMALL;
-                       }
-
                        memset(data+next_offset, 0, align);
                        next_offset += align;