]> git.samba.org - kai/samba-autobuild/.git/blobdiff - source3/smbd/trans2.c
Add a more explaining comment
[kai/samba-autobuild/.git] / source3 / smbd / trans2.c
index 9e56434d5c1818c26d7642732bee0b44e29daafb..2e2da5cc71ff52bbb74156a74a26b6654ce25a10 100644 (file)
@@ -28,7 +28,6 @@
 extern int max_send;
 extern enum protocol_types Protocol;
 extern uint32 global_client_caps;
-extern struct current_user current_user;
 
 #define get_file_size(sbuf) ((sbuf).st_size)
 #define DIR_ENTRY_SAFETY_MARGIN 4096
@@ -178,7 +177,7 @@ NTSTATUS get_ea_names_from_file(TALLOC_CTX *mem_ctx, connection_struct *conn,
        char *p;
        char **names, **tmp;
        size_t num_names;
-       ssize_t sizeret;
+       ssize_t sizeret = -1;
 
        if (!lp_ea_support(SNUM(conn))) {
                *pnames = NULL;
@@ -504,7 +503,7 @@ NTSTATUS set_ea(connection_struct *conn, files_struct *fsp, const char *fname, s
 static struct ea_list *read_ea_name_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size)
 {
        struct ea_list *ea_list_head = NULL;
-       size_t offset = 0;
+       size_t converted_size, offset = 0;
 
        while (offset + 2 < data_size) {
                struct ea_list *eal = TALLOC_ZERO_P(ctx, struct ea_list);
@@ -522,7 +521,11 @@ static struct ea_list *read_ea_name_list(TALLOC_CTX *ctx, const char *pdata, siz
                if (pdata[offset + namelen] != '\0') {
                        return NULL;
                }
-               pull_ascii_talloc(ctx, &eal->ea.name, &pdata[offset]);
+               if (!pull_ascii_talloc(ctx, &eal->ea.name, &pdata[offset],
+                                      &converted_size)) {
+                       DEBUG(0,("read_ea_name_list: pull_ascii_talloc "
+                                "failed: %s", strerror(errno)));
+               }
                if (!eal->ea.name) {
                        return NULL;
                }
@@ -544,6 +547,7 @@ struct ea_list *read_ea_list_entry(TALLOC_CTX *ctx, const char *pdata, size_t da
        struct ea_list *eal = TALLOC_ZERO_P(ctx, struct ea_list);
        uint16 val_len;
        unsigned int namelen;
+       size_t converted_size;
 
        if (!eal) {
                return NULL;
@@ -565,7 +569,10 @@ struct ea_list *read_ea_list_entry(TALLOC_CTX *ctx, const char *pdata, size_t da
        if (pdata[namelen + 4] != '\0') {
                return NULL;
        }
-       pull_ascii_talloc(ctx, &eal->ea.name, pdata + 4);
+       if (!pull_ascii_talloc(ctx, &eal->ea.name, pdata + 4, &converted_size)) {
+               DEBUG(0,("read_ea_list_entry: pull_ascii_talloc failed: %s",
+                        strerror(errno)));
+       }
        if (!eal->ea.name) {
                return NULL;
        }
@@ -737,14 +744,16 @@ void send_trans2_replies(connection_struct *conn,
                                    + alignment_offset
                                    + data_alignment_offset);
 
-       /* useable_space can never be more than max_send minus the alignment offset. */
-
-       useable_space = MIN(useable_space, max_send - (alignment_offset+data_alignment_offset));
+       if (useable_space < 0) {
+               DEBUG(0, ("send_trans2_replies failed sanity useable_space "
+                         "= %d!!!", useable_space));
+               exit_server_cleanly("send_trans2_replies: Not enough space");
+       }
 
        while (params_to_send || data_to_send) {
                /* Calculate whether we will totally or partially fill this packet */
 
-               total_sent_thistime = params_to_send + data_to_send + alignment_offset + data_alignment_offset;
+               total_sent_thistime = params_to_send + data_to_send;
 
                /* We can never send more than useable_space */
                /*
@@ -754,9 +763,10 @@ void send_trans2_replies(connection_struct *conn,
                 * are sent here. Fix from Marc_Jacobsen@hp.com.
                 */
 
-               total_sent_thistime = MIN(total_sent_thistime, useable_space+ alignment_offset + data_alignment_offset);
+               total_sent_thistime = MIN(total_sent_thistime, useable_space);
 
-               reply_outbuf(req, 10, total_sent_thistime);
+               reply_outbuf(req, 10, total_sent_thistime + alignment_offset
+                            + data_alignment_offset);
 
                /* Set total params and data to be sent */
                SSVAL(req->outbuf,smb_tprcnt,paramsize);
@@ -1195,6 +1205,32 @@ static NTSTATUS unix_perms_from_wire( connection_struct *conn,
        return NT_STATUS_OK;
 }
 
+/****************************************************************************
+ Needed to show the msdfs symlinks as directories. Modifies psbuf
+ to be a directory if it's a msdfs link.
+****************************************************************************/
+
+static bool check_msdfs_link(connection_struct *conn,
+                               const char *pathname,
+                               SMB_STRUCT_STAT *psbuf)
+{
+       int saved_errno = errno;
+       if(lp_host_msdfs() &&
+               lp_msdfs_root(SNUM(conn)) &&
+               is_msdfs_link(conn, pathname, psbuf)) {
+
+               DEBUG(5,("check_msdfs_link: Masquerading msdfs link %s "
+                       "as a directory\n",
+                       pathname));
+               psbuf->st_mode = (psbuf->st_mode & 0xFFF) | S_IFDIR;
+               errno = saved_errno;
+               return true;
+       }
+       errno = saved_errno;
+       return false;
+}
+
+
 /****************************************************************************
  Get a level dependent lanman2 dir entry.
 ****************************************************************************/
@@ -1207,6 +1243,7 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
                                int info_level,
                                int requires_resume_key,
                                bool dont_descend,
+                               bool ask_sharemode,
                                char **ppdata,
                                char *base_data,
                                char *end_data,
@@ -1238,7 +1275,6 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
        bool needslash = ( conn->dirpath[strlen(conn->dirpath) -1] != '/');
        bool check_mangled_names = lp_manglednames(conn->params);
        char mangled_name[13]; /* mangled 8.3 name. */
-       struct timespec write_time_ts;
 
        *out_of_space = False;
        *got_exact_match = False;
@@ -1360,16 +1396,8 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
                                /* Needed to show the msdfs symlinks as
                                 * directories */
 
-                               if(lp_host_msdfs() &&
-                                  lp_msdfs_root(SNUM(conn)) &&
-                                  ((ms_dfs_link = is_msdfs_link(conn, pathreal, &sbuf)) == True)) {
-                                       DEBUG(5,("get_lanman2_dir_entry: Masquerading msdfs link %s "
-                                               "as a directory\n",
-                                               pathreal));
-                                       sbuf.st_mode = (sbuf.st_mode & 0xFFF) | S_IFDIR;
-
-                               } else {
-
+                               ms_dfs_link = check_msdfs_link(conn, pathreal, &sbuf);
+                               if (!ms_dfs_link) {
                                        DEBUG(5,("get_lanman2_dir_entry:Couldn't stat [%s] (%s)\n",
                                                pathreal,strerror(errno)));
                                        TALLOC_FREE(pathreal);
@@ -1398,10 +1426,15 @@ static bool get_lanman2_dir_entry(TALLOC_CTX *ctx,
                        adate_ts = get_atimespec(&sbuf);
                        create_date_ts = get_create_timespec(&sbuf,lp_fake_dir_create_times(SNUM(conn)));
 
-                       get_file_infos(vfs_file_id_from_sbuf(conn, &sbuf),
-                                      NULL, &write_time_ts);
-                       if (!null_timespec(write_time_ts)) {
-                               mdate_ts = write_time_ts;
+                       if (ask_sharemode) {
+                               struct timespec write_time_ts;
+                               struct file_id fileid;
+
+                               fileid = vfs_file_id_from_sbuf(conn, &sbuf);
+                               get_file_infos(fileid, NULL, &write_time_ts);
+                               if (!null_timespec(write_time_ts)) {
+                                       mdate_ts = write_time_ts;
+                               }
                        }
 
                        if (lp_dos_filetime_resolution(SNUM(conn))) {
@@ -1873,6 +1906,7 @@ static void call_trans2findfirst(connection_struct *conn,
        SMB_STRUCT_STAT sbuf;
        struct ea_list *ea_list = NULL;
        NTSTATUS ntstatus = NT_STATUS_OK;
+       bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
        TALLOC_CTX *ctx = talloc_tos();
 
        if (total_params < 13) {
@@ -1911,6 +1945,8 @@ close_if_end = %d requires_resume_key = %d level = 0x%x, max_data_bytes = %d\n",
                        break;
                case SMB_FIND_FILE_UNIX:
                case SMB_FIND_FILE_UNIX_INFO2:
+                       /* Always use filesystem for UNIX mtime query. */
+                       ask_sharemode = false;
                        if (!lp_unix_extensions()) {
                                reply_nterror(req, NT_STATUS_INVALID_LEVEL);
                                return;
@@ -2069,6 +2105,7 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
                                        req->flags2,
                                        mask,dirtype,info_level,
                                        requires_resume_key,dont_descend,
+                                       ask_sharemode,
                                        &p,pdata,data_end,
                                        space_remaining, &out_of_space,
                                        &got_exact_match,
@@ -2205,6 +2242,7 @@ static void call_trans2findnext(connection_struct *conn,
        int space_remaining;
        struct ea_list *ea_list = NULL;
        NTSTATUS ntstatus = NT_STATUS_OK;
+       bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
        TALLOC_CTX *ctx = talloc_tos();
 
        if (total_params < 13) {
@@ -2266,6 +2304,8 @@ resume_key = %d resume name = %s continue=%d level = %d\n",
                        break;
                case SMB_FIND_FILE_UNIX:
                case SMB_FIND_FILE_UNIX_INFO2:
+                       /* Always use filesystem for UNIX mtime query. */
+                       ask_sharemode = false;
                        if (!lp_unix_extensions()) {
                                reply_nterror(req, NT_STATUS_INVALID_LEVEL);
                                return;
@@ -2413,6 +2453,7 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
                                                req->flags2,
                                                mask,dirtype,info_level,
                                                requires_resume_key,dont_descend,
+                                               ask_sharemode,
                                                &p,pdata,data_end,
                                                space_remaining, &out_of_space,
                                                &got_exact_match,
@@ -2798,9 +2839,11 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
                        fsp.fnum = -1;
                        
                        /* access check */
-                       if (current_user.ut.uid != 0) {
-                               DEBUG(0,("set_user_quota: access_denied service [%s] user [%s]\n",
-                                       lp_servicename(SNUM(conn)),conn->user));
+                       if (conn->server_info->utok.uid != 0) {
+                               DEBUG(0,("set_user_quota: access_denied "
+                                        "service [%s] user [%s]\n",
+                                        lp_servicename(SNUM(conn)),
+                                        conn->server_info->unix_name));
                                reply_doserror(req, ERRDOS, ERRnoaccess);
                                return;
                        }
@@ -2960,7 +3003,7 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
                         * in our list of SIDs.
                         */
                        if (nt_token_check_sid(&global_sid_Builtin_Guests,
-                                   current_user.nt_user_token)) {
+                                              conn->server_info->ptok)) {
                                flags |= SMB_WHOAMI_GUEST;
                        }
 
@@ -2968,7 +3011,7 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
                         * is in our list of SIDs.
                         */
                        if (nt_token_check_sid(&global_sid_Authenticated_Users,
-                                   current_user.nt_user_token)) {
+                                              conn->server_info->ptok)) {
                                flags &= ~SMB_WHOAMI_GUEST;
                        }
 
@@ -2984,16 +3027,18 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
                            + 4 /* num_sids */
                            + 4 /* SID bytes */
                            + 4 /* pad/reserved */
-                           + (current_user.ut.ngroups * 8)
+                           + (conn->server_info->utok.ngroups * 8)
                                /* groups list */
-                           + (current_user.nt_user_token->num_sids *
+                           + (conn->server_info->ptok->num_sids *
                                    SID_MAX_SIZE)
                                /* SID list */;
 
                        SIVAL(pdata, 0, flags);
                        SIVAL(pdata, 4, SMB_WHOAMI_MASK);
-                       SBIG_UINT(pdata, 8, (SMB_BIG_UINT)current_user.ut.uid);
-                       SBIG_UINT(pdata, 16, (SMB_BIG_UINT)current_user.ut.gid);
+                       SBIG_UINT(pdata, 8,
+                                 (SMB_BIG_UINT)conn->server_info->utok.uid);
+                       SBIG_UINT(pdata, 16,
+                                 (SMB_BIG_UINT)conn->server_info->utok.gid);
 
 
                        if (data_len >= max_data_bytes) {
@@ -3008,18 +3053,18 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
                                break;
                        }
 
-                       SIVAL(pdata, 24, current_user.ut.ngroups);
-                       SIVAL(pdata, 28,
-                               current_user.nt_user_token->num_sids);
+                       SIVAL(pdata, 24, conn->server_info->utok.ngroups);
+                       SIVAL(pdata, 28, conn->server_info->num_sids);
 
                        /* We walk the SID list twice, but this call is fairly
                         * infrequent, and I don't expect that it's performance
                         * sensitive -- jpeach
                         */
                        for (i = 0, sid_bytes = 0;
-                           i < current_user.nt_user_token->num_sids; ++i) {
+                            i < conn->server_info->ptok->num_sids; ++i) {
                                sid_bytes += ndr_size_dom_sid(
-                                       &current_user.nt_user_token->user_sids[i], 0);
+                                       &conn->server_info->ptok->user_sids[i],
+                                       0);
                        }
 
                        /* SID list byte count */
@@ -3030,20 +3075,21 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)bsize, (unsigned
                        data_len = 40;
 
                        /* GID list */
-                       for (i = 0; i < current_user.ut.ngroups; ++i) {
+                       for (i = 0; i < conn->server_info->utok.ngroups; ++i) {
                                SBIG_UINT(pdata, data_len,
-                                       (SMB_BIG_UINT)current_user.ut.groups[i]);
+                                         (SMB_BIG_UINT)conn->server_info->utok.groups[i]);
                                data_len += 8;
                        }
 
                        /* SID list */
                        for (i = 0;
-                           i < current_user.nt_user_token->num_sids; ++i) {
+                           i < conn->server_info->ptok->num_sids; ++i) {
                                int sid_len = ndr_size_dom_sid(
-                                       &current_user.nt_user_token->user_sids[i], 0);
+                                       &conn->server_info->ptok->user_sids[i],
+                                       0);
 
                                sid_linearize(pdata + data_len, sid_len,
-                                   &current_user.nt_user_token->user_sids[i]);
+                                   &conn->server_info->ptok->user_sids[i]);
                                data_len += sid_len;
                        }
 
@@ -3238,9 +3284,11 @@ cap_low = 0x%x, cap_high = 0x%x\n",
                                ZERO_STRUCT(quotas);
 
                                /* access check */
-                               if ((current_user.ut.uid != 0)||!CAN_WRITE(conn)) {
+                               if ((conn->server_info->utok.uid != 0)
+                                   ||!CAN_WRITE(conn)) {
                                        DEBUG(0,("set_user_quota: access_denied service [%s] user [%s]\n",
-                                               lp_servicename(SNUM(conn)),conn->user));
+                                                lp_servicename(SNUM(conn)),
+                                                conn->server_info->unix_name));
                                        reply_doserror(req, ERRSRV, ERRaccess);
                                        return;
                                }
@@ -3250,7 +3298,9 @@ cap_low = 0x%x, cap_high = 0x%x\n",
                                 * --metze 
                                 */
                                fsp = file_fsp(SVAL(params,0));
-                               if (!CHECK_NTQUOTA_HANDLE_OK(fsp,conn)) {
+
+                               if (!check_fsp_ntquota_handle(conn, req,
+                                                             fsp)) {
                                        DEBUG(3,("TRANSACT_GET_USER_QUOTA: no valid QUOTA HANDLE\n"));
                                        reply_nterror(
                                                req, NT_STATUS_INVALID_HANDLE);
@@ -3635,10 +3685,10 @@ static NTSTATUS marshall_stream_info(unsigned int num_streams,
                size_t namelen;
                smb_ucs2_t *namebuf;
 
-               namelen = push_ucs2_talloc(talloc_tos(), &namebuf,
-                                           streams[i].name);
-
-               if ((namelen == (size_t)-1) || (namelen <= 2)) {
+               if (!push_ucs2_talloc(talloc_tos(), &namebuf,
+                                     streams[i].name, &namelen) ||
+                   namelen <= 2)
+               {
                        return NT_STATUS_INVALID_PARAMETER;
                }
 
@@ -3797,6 +3847,7 @@ static void call_trans2qfilepathinfo(connection_struct *conn,
        struct ea_list *ea_list = NULL;
        uint32 access_mask = 0x12019F; /* Default - GENERIC_EXECUTE mapping from Windows */
        char *lock_data = NULL;
+       bool ms_dfs_link = false;
        TALLOC_CTX *ctx = talloc_tos();
 
        if (!params) {
@@ -3832,7 +3883,7 @@ static void call_trans2qfilepathinfo(connection_struct *conn,
                }
 
                /* Initial check for valid fsp ptr. */
-               if (!check_fsp_open(conn, req, fsp, &current_user)) {
+               if (!check_fsp_open(conn, req, fsp)) {
                        return;
                }
 
@@ -3875,7 +3926,7 @@ static void call_trans2qfilepathinfo(connection_struct *conn,
                        /*
                         * Original code - this is an open file.
                         */
-                       if (!check_fsp(conn, req, fsp, &current_user)) {
+                       if (!check_fsp(conn, req, fsp)) {
                                return;
                        }
 
@@ -3950,10 +4001,15 @@ static void call_trans2qfilepathinfo(connection_struct *conn,
                                reply_unixerror(req, ERRDOS, ERRbadpath);
                                return;
                        }
+
                } else if (!VALID_STAT(sbuf) && SMB_VFS_STAT(conn,fname,&sbuf) && (info_level != SMB_INFO_IS_NAME_VALID)) {
-                       DEBUG(3,("call_trans2qfilepathinfo: SMB_VFS_STAT of %s failed (%s)\n",fname,strerror(errno)));
-                       reply_unixerror(req, ERRDOS, ERRbadpath);
-                       return;
+                       ms_dfs_link = check_msdfs_link(conn,fname,&sbuf);
+
+                       if (!ms_dfs_link) {
+                               DEBUG(3,("call_trans2qfilepathinfo: SMB_VFS_STAT of %s failed (%s)\n",fname,strerror(errno)));
+                               reply_unixerror(req, ERRDOS, ERRbadpath);
+                               return;
+                       }
                }
 
                fileid = vfs_file_id_from_sbuf(conn, &sbuf);
@@ -3978,7 +4034,11 @@ static void call_trans2qfilepathinfo(connection_struct *conn,
        else
                base_name = p+1;
 
-       mode = dos_mode(conn,fname,&sbuf);
+       if (ms_dfs_link) {
+               mode = dos_mode_msdfs(conn,fname,&sbuf);
+       } else {
+               mode = dos_mode(conn,fname,&sbuf);
+       }
        if (!mode)
                mode = FILE_ATTRIBUTE_NORMAL;
 
@@ -4092,7 +4152,7 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
                }
        }
 
-       if (!null_timespec(write_time_ts)) {
+       if (!null_timespec(write_time_ts) && !INFO_LEVEL_IS_UNIX(info_level)) {
                mtime_ts = write_time_ts;
        }
 
@@ -4847,11 +4907,11 @@ NTSTATUS smb_set_file_time(connection_struct *conn,
                          time_to_asc(convert_timespec_to_time_t(ts[1])) ));
 
                if (fsp != NULL) {
-                       set_write_time_fsp(fsp, ts[1], true);
+                       set_sticky_write_time_fsp(fsp, ts[1]);
                } else {
-                       set_write_time_path(conn, fname,
+                       set_sticky_write_time_path(conn, fname,
                                            vfs_file_id_from_sbuf(conn, psbuf),
-                                           ts[1], true);
+                                           ts[1]);
                }
        }
 
@@ -4935,6 +4995,7 @@ static NTSTATUS smb_set_file_size(connection_struct *conn,
                if (vfs_set_filelen(fsp, size) == -1) {
                        return map_nt_error_from_unix(errno);
                }
+               trigger_write_time_update_immediate(fsp);
                return NT_STATUS_OK;
        }
 
@@ -4958,6 +5019,7 @@ static NTSTATUS smb_set_file_size(connection_struct *conn,
                return status;
        }
 
+       trigger_write_time_update_immediate(new_fsp);
        close_file(new_fsp,NORMAL_CLOSE);
        return NT_STATUS_OK;
 }
@@ -5044,7 +5106,8 @@ static NTSTATUS smb_set_file_disposition_info(connection_struct *conn,
        }
 
        /* The set is across all open files on this dev/inode pair. */
-       if (!set_delete_on_close(fsp, delete_on_close, &current_user.ut)) {
+       if (!set_delete_on_close(fsp, delete_on_close,
+                                &conn->server_info->utok)) {
                return NT_STATUS_ACCESS_DENIED;
        }
        return NT_STATUS_OK;
@@ -5683,7 +5746,7 @@ static NTSTATUS smb_set_file_allocation_info(connection_struct *conn,
                 * This is equivalent to a write. Ensure it's seen immediately
                 * if there are no pending writes.
                 */
-               trigger_write_time_update(fsp);
+               trigger_write_time_update_immediate(fsp);
                return NT_STATUS_OK;
        }
 
@@ -5717,7 +5780,7 @@ static NTSTATUS smb_set_file_allocation_info(connection_struct *conn,
         * This is equivalent to a write. Ensure it's seen immediately
         * if there are no pending writes.
         */
-       trigger_write_time_update(new_fsp);
+       trigger_write_time_update_immediate(new_fsp);
 
        close_file(new_fsp,NORMAL_CLOSE);
        return NT_STATUS_OK;
@@ -5831,7 +5894,7 @@ static NTSTATUS smb_unix_mknod(connection_struct *conn,
         */
 
        if (lp_inherit_perms(SNUM(conn))) {
-               inherit_access_acl(
+               inherit_access_posix_acl(
                        conn, parent_dirname(fname),
                        fname, unixmode);
        }
@@ -6520,7 +6583,7 @@ static void call_trans2setfilepathinfo(connection_struct *conn,
 
                fsp = file_fsp(SVAL(params,0));
                /* Basic check for non-null fsp. */
-               if (!check_fsp_open(conn, req, fsp, &current_user)) {
+               if (!check_fsp_open(conn, req, fsp)) {
                        return;
                }
                info_level = SVAL(params,2);
@@ -6573,7 +6636,7 @@ static void call_trans2setfilepathinfo(connection_struct *conn,
                        /*
                         * Original code - this is an open file.
                         */
-                       if (!check_fsp(conn, req, fsp, &current_user)) {
+                       if (!check_fsp(conn, req, fsp)) {
                                return;
                        }
 
@@ -7459,7 +7522,8 @@ void reply_trans2(struct smb_request *req)
        unsigned int psoff;
        unsigned int pscnt;
        unsigned int tran_call;
-       int size;
+       unsigned int size;
+       unsigned int av_size;
        struct trans_state *state;
        NTSTATUS result;
 
@@ -7477,6 +7541,7 @@ void reply_trans2(struct smb_request *req)
        pscnt = SVAL(req->inbuf, smb_pscnt);
        tran_call = SVAL(req->inbuf, smb_setup0);
        size = smb_len(req->inbuf) + 4;
+       av_size = smb_len(req->inbuf);
 
        result = allow_new_trans(conn->pending_trans, req->mid);
        if (!NT_STATUS_IS_OK(result)) {
@@ -7503,7 +7568,7 @@ void reply_trans2(struct smb_request *req)
                }
        }
 
-       if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
+       if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
                DEBUG(0, ("talloc failed\n"));
                reply_nterror(req, NT_STATUS_NO_MEMORY);
                END_PROFILE(SMBtrans2);
@@ -7569,12 +7634,17 @@ void reply_trans2(struct smb_request *req)
                        END_PROFILE(SMBtrans2);
                        return;
                }
-               if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
+
+               if (dscnt > state->total_data ||
+                               dsoff+dscnt < dsoff) {
                        goto bad_param;
-               if ((smb_base(req->inbuf)+dsoff+dscnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf)+dsoff+dscnt < smb_base(req->inbuf)))
+               }
+
+               if (dsoff > av_size ||
+                               dscnt > av_size ||
+                               dsoff+dscnt > av_size) {
                        goto bad_param;
+               }
 
                memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
        }
@@ -7592,12 +7662,17 @@ void reply_trans2(struct smb_request *req)
                        END_PROFILE(SMBtrans2);
                        return;
                } 
-               if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
+
+               if (pscnt > state->total_param ||
+                               psoff+pscnt < psoff) {
                        goto bad_param;
-               if ((smb_base(req->inbuf)+psoff+pscnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf)+psoff+pscnt < smb_base(req->inbuf)))
+               }
+
+               if (psoff > av_size ||
+                               pscnt > av_size ||
+                               psoff+pscnt > av_size) {
                        goto bad_param;
+               }
 
                memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
        }
@@ -7646,7 +7721,8 @@ void reply_transs2(struct smb_request *req)
        connection_struct *conn = req->conn;
        unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
        struct trans_state *state;
-       int size;
+       unsigned int size;
+       unsigned int av_size;
 
        START_PROFILE(SMBtranss2);
 
@@ -7659,6 +7735,7 @@ void reply_transs2(struct smb_request *req)
        }
 
        size = smb_len(req->inbuf)+4;
+       av_size = smb_len(req->inbuf);
 
        for (state = conn->pending_trans; state != NULL;
             state = state->next) {
@@ -7697,36 +7774,38 @@ void reply_transs2(struct smb_request *req)
                goto bad_param;
 
        if (pcnt) {
-               if (pdisp+pcnt > state->total_param)
-                       goto bad_param;
-               if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
-                       goto bad_param;
-               if (pdisp > state->total_param)
+               if (pdisp > state->total_param ||
+                               pcnt > state->total_param ||
+                               pdisp+pcnt > state->total_param ||
+                               pdisp+pcnt < pdisp) {
                        goto bad_param;
-               if ((smb_base(req->inbuf) + poff + pcnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf) + poff + pcnt < smb_base(req->inbuf)))
-                       goto bad_param;
-               if (state->param + pdisp < state->param)
+               }
+
+               if (poff > av_size ||
+                               pcnt > av_size ||
+                               poff+pcnt > av_size ||
+                               poff+pcnt < poff) {
                        goto bad_param;
+               }
 
                memcpy(state->param+pdisp,smb_base(req->inbuf)+poff,
                       pcnt);
        }
 
        if (dcnt) {
-               if (ddisp+dcnt > state->total_data)
-                       goto bad_param;
-               if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
-                       goto bad_param;
-               if (ddisp > state->total_data)
-                       goto bad_param;
-               if ((smb_base(req->inbuf) + doff + dcnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf) + doff + dcnt < smb_base(req->inbuf)))
+               if (ddisp > state->total_data ||
+                               dcnt > state->total_data ||
+                               ddisp+dcnt > state->total_data ||
+                               ddisp+dcnt < ddisp) {
                        goto bad_param;
-               if (state->data + ddisp < state->data)
+               }
+
+               if (ddisp > av_size ||
+                               dcnt > av_size ||
+                               ddisp+dcnt > av_size ||
+                               ddisp+dcnt < ddisp) {
                        goto bad_param;
+               }
 
                memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
                       dcnt);