Don't believe len returned from read_smb_length_return_keepalive(),

it may be a UNIX large writeX (which wraps len in that case).
Stevef this should fix your 128k write bug.
Jeremy.
(This used to be commit de2ebffa3c99ed28a3868fd956ef45629ca855b6)

diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index aa39b012588128bfa6c0571d504a037b666d78f4..659b7b55e99620001ac3fe553d52213300a6bcd5 100644 (file)
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -259,7 +259,7 @@ static ssize_t receive_smb_raw_talloc(TALLOC_CTX *mem_ctx,
 
        if (CVAL(lenbuf,0) != SMBkeepalive &&
                        min_recv_size &&
-                       len > min_recv_size &&
+                       smb_len_large(lenbuf) > min_recv_size && /* Could be a UNIX large writeX. */
                        !srv_is_signing_active()) {
 
                return receive_smb_raw_talloc_partial_read(mem_ctx,