r5100: We should only care about case-sensitivity when *reading* an incoming
[ira/wip.git] / source / smbd / reply.c
index c470d15645da811bf6c4c082227364ca59cc5ffa..56d42712133f01f2424726f0dd9b4850ba503330 100644 (file)
 #include "includes.h"
 
 /* look in server.c for some explanation of these variables */
-extern int Protocol;
+extern enum protocol_types Protocol;
 extern int max_send;
 extern int max_recv;
 extern char magic_char;
-extern BOOL case_sensitive;
-extern BOOL case_preserve;
-extern BOOL short_case_preserve;
-extern BOOL is_unix_charset_unsafe;
 extern int global_oplock_break;
 unsigned int smb_echo_count = 0;
+extern uint32 global_client_caps;
 
 extern BOOL global_encrypted_passwords_negotiated;
 
@@ -47,11 +44,13 @@ extern BOOL global_encrypted_passwords_negotiated;
  set.
 ****************************************************************************/
 
-NTSTATUS check_path_syntax(pstring destname, const pstring srcname)
+NTSTATUS check_path_syntax(pstring destname, const pstring srcname, BOOL allow_wcard_names)
 {
        char *d = destname;
        const char *s = srcname;
        NTSTATUS ret = NT_STATUS_OK;
+       BOOL start_of_name_component = True;
+       unsigned int num_bad_components = 0;
 
        while (*s) {
                if (IS_DIRECTORY_SEP(*s)) {
@@ -66,79 +65,111 @@ NTSTATUS check_path_syntax(pstring destname, const pstring srcname)
                                /* We only care about non-leading or trailing '/' or '\\' */
                                *d++ = '/';
                        }
-               } else if ((s[0] == '.') && (s[1] == '.') && (IS_DIRECTORY_SEP(s[2]) || s[2] == '\0')) {
-                       /* Uh oh - "../" or "..\\"  or "..\0" ! */
 
-                       /*
-                        * No mb char starts with '.' so we're safe checking the directory separator here.
-                        */
+                       start_of_name_component = True;
+                       continue;
+               }
+
+               if (start_of_name_component) {
+                       if ((s[0] == '.') && (s[1] == '.') && (IS_DIRECTORY_SEP(s[2]) || s[2] == '\0')) {
+                               /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 
-                       /* If we just added a '/', delete it. */
+                               /*
+                                * No mb char starts with '.' so we're safe checking the directory separator here.
+                                */
 
-                       if ((d > destname) && (*(d-1) == '/')) {
-                               *(d-1) = '\0';
-                               if (d == (destname + 1)) {
+                               /* If  we just added a '/' - delete it */
+                               if ((d > destname) && (*(d-1) == '/')) {
+                                       *(d-1) = '\0';
                                        d--;
-                               } else {
-                                       d -= 2;
                                }
-                       }
-                       /* Are we at the start ? Can't go back further if so. */
-                       if (d == destname) {
-                               return NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
-                       }
-                       /* Go back one level... */
-                       while (d > destname) {
-                               if (*d == '/')
+
+                               /* Are we at the start ? Can't go back further if so. */
+                               if (d <= destname) {
+                                       ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
                                        break;
-                               d--;
-                       }
-                       s += 3;
-               } else if ((s[0] == '.') && IS_DIRECTORY_SEP(s[1])) {
+                               }
+                               /* Go back one level... */
+                               /* We know this is safe as '/' cannot be part of a mb sequence. */
+                               /* NOTE - if this assumption is invalid we are not in good shape... */
+                               /* Decrement d first as d points to the *next* char to write into. */
+                               for (d--; d > destname; d--) {
+                                       if (*d == '/')
+                                               break;
+                               }
+                               s += 2; /* Else go past the .. */
+                               /* We're still at the start of a name component, just the previous one. */
 
-                       /*
-                        * No mb char starts with '.' so we're safe checking the directory separator here.
-                        */
+                               if (num_bad_components) {
+                                       /* Hmmm. Should we only decrement the bad_components if
+                                          we're removing a bad component ? Need to check this. JRA. */
+                                       num_bad_components--;
+                               }
 
-                       /* "./" or ".\\" fails with a different error depending on where it is... */
+                               continue;
 
-                       if (s == srcname) {
-                               ret = NT_STATUS_OBJECT_NAME_INVALID;
+                       } else if ((s[0] == '.') && ((s[1] == '\0') || IS_DIRECTORY_SEP(s[1]))) {
+                               /* Component of pathname can't be "." only. */
+                               ret =  NT_STATUS_OBJECT_NAME_INVALID;
+                               num_bad_components++;
+                               *d++ = *s++;
+                               continue;
+                       }
+               }
+
+               if (!(*s & 0x80)) {
+                       if (allow_wcard_names) {
+                               *d++ = *s++;
                        } else {
-                               if (s[2] == '\0') {
-                                       return NT_STATUS_INVALID_PARAMETER;
+                               switch (*s) {
+                                       case '*':
+                                       case '?':
+                                       case '<':
+                                       case '>':
+                                       case '"':
+                                               return NT_STATUS_OBJECT_NAME_INVALID;
+                                       default:
+                                               *d++ = *s++;
+                                               break;
                                }
-                               ret = NT_STATUS_OBJECT_PATH_NOT_FOUND;
                        }
-                       s++;
                } else {
-                       /* Activate this codepath only if we know that Unix charset may contain unsafe '\\' */
-                       if ((is_unix_charset_unsafe == True) && ((*s & 0x80) && IS_DIRECTORY_SEP(s[1]))) {
-                               /* 
-                                * Potential mb char with second char a directory separator.
-                                * All the encodings we care about are 2 byte only, so do a
-                                * conversion to unicode. If the one byte char converts then
-                                * it really is a directory separator following. Otherwise if
-                                * the two byte character converts (and it should or our assumption
-                                * about character sets is broken and we return an error) then copy both
-                                * bytes as it's a MB character, not a directory separator.
-                                */
-
-                               uint16 ucs2_val;
-
-                               if (convert_string(CH_UNIX, CH_UCS2, s, 1, &ucs2_val, 2, False) == 2) {
-                                       ;
-                               } else if (convert_string(CH_UNIX, CH_UCS2, s, 2, &ucs2_val, 2, False) == 2) {
+                       switch(next_mb_char_size(s)) {
+                               case 4:
+                                       *d++ = *s++;
+                               case 3:
+                                       *d++ = *s++;
+                               case 2:
+                                       *d++ = *s++;
+                               case 1:
                                        *d++ = *s++;
-                               } else {
-                                       DEBUG(0,("check_path_syntax: directory separator assumptions invalid !\n"));
+                                       break;
+                               default:
+                                       DEBUG(0,("check_path_syntax: character length assumptions invalid !\n"));
+                                       *d = '\0';
                                        return NT_STATUS_INVALID_PARAMETER;
-                               }
                        }
-                       /* Just copy the char (or the second byte of the mb char). */
-                       *d++ = *s++;
+               }
+               if (start_of_name_component && num_bad_components) {
+                       num_bad_components++;
+               }
+               start_of_name_component = False;
+       }
+
+       if (NT_STATUS_EQUAL(ret, NT_STATUS_OBJECT_NAME_INVALID)) {
+               /* For some strange reason being called from findfirst changes
+                  the num_components number to cause the error return to change. JRA. */
+               if (allow_wcard_names) {
+                       if (num_bad_components > 2) {
+                               ret = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+                       }
+               } else {
+                       if (num_bad_components > 1) {
+                               ret = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+                       }
                }
        }
+
        *d = '\0';
        return ret;
 }
@@ -147,7 +178,7 @@ NTSTATUS check_path_syntax(pstring destname, const pstring srcname)
  Pull a string and check the path - provide for error return.
 ****************************************************************************/
 
-size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags, NTSTATUS *err)
+size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len, size_t src_len, int flags, NTSTATUS *err, BOOL allow_wcard_names)
 {
        pstring tmppath;
        char *tmppath_ptr = tmppath;
@@ -161,7 +192,7 @@ size_t srvstr_get_path(char *inbuf, char *dest, const char *src, size_t dest_len
        } else {
                ret = srvstr_pull( inbuf, tmppath_ptr, src, dest_len, src_len, flags);
        }
-       *err = check_path_syntax(dest, tmppath);
+       *err = check_path_syntax(dest, tmppath, allow_wcard_names);
        return ret;
 }
 
@@ -228,8 +259,6 @@ int reply_special(char *inbuf,char *outbuf)
                reload_services(True);
                reopen_logs();
 
-               claim_connection(NULL,"",0,True,FLAG_MSG_GENERAL|FLAG_MSG_SMBD);
-
                already_got_session = True;
                break;
                
@@ -489,7 +518,9 @@ int reply_ioctl(connection_struct *conn,
                        }
                        SSVAL(p,0,fsp->rap_print_jobid);             /* Job number */
                        srvstr_push(outbuf, p+2, global_myname(), 15, STR_TERMINATE|STR_ASCII);
-                       srvstr_push(outbuf, p+18, lp_servicename(SNUM(conn)), 13, STR_TERMINATE|STR_ASCII);
+                       if (conn) {
+                               srvstr_push(outbuf, p+18, lp_servicename(SNUM(conn)), 13, STR_TERMINATE|STR_ASCII);
+                       }
                        break;
                }
        }
@@ -505,7 +536,6 @@ int reply_ioctl(connection_struct *conn,
 int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size, int dum_buffsize)
 {
        int outsize = 0;
-       int mode;
        pstring name;
        BOOL ok = False;
        BOOL bad_path = False;
@@ -514,7 +544,7 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 
        START_PROFILE(SMBchkpth);
 
-       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBchkpth);
                return ERROR_NT(status);
@@ -523,8 +553,10 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        RESOLVE_DFSPATH(name, conn, inbuf, outbuf);
 
        unix_convert(name,conn,0,&bad_path,&sbuf);
-
-       mode = SVAL(inbuf,smb_vwv0);
+       if (bad_path) {
+               END_PROFILE(SMBchkpth);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
 
        if (check_name(name,conn)) {
                if (VALID_STAT(sbuf) || SMB_VFS_STAT(conn,name,&sbuf) == 0)
@@ -546,18 +578,11 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                         * the parent directory is valid but not the
                         * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
                         * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
-                        * if the path is invalid.
+                        * if the path is invalid. This is different from set_bad_path_error()
+                        * in the non-NT error case.
                         */
-                       if (bad_path) {
-                               END_PROFILE(SMBchkpth);
-                               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
-                       } else {
-                               END_PROFILE(SMBchkpth);
-                               return ERROR_NT(NT_STATUS_OBJECT_NAME_NOT_FOUND);
-                       }
-               } else if (errno == ENOTDIR) {
                        END_PROFILE(SMBchkpth);
-                       return ERROR_NT(NT_STATUS_NOT_A_DIRECTORY);
+                       return ERROR_BOTH(NT_STATUS_OBJECT_NAME_NOT_FOUND,ERRDOS,ERRbadpath);
                }
 
                END_PROFILE(SMBchkpth);
@@ -565,8 +590,7 @@ int reply_chkpth(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        }
 
        outsize = set_message(outbuf,0,0,True);
-
-       DEBUG(3,("chkpth %s mode=%d\n", name, mode));
+       DEBUG(3,("chkpth %s mode=%d\n", name, (int)SVAL(inbuf,smb_vwv0)));
 
        END_PROFILE(SMBchkpth);
        return(outsize);
@@ -592,7 +616,7 @@ int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        START_PROFILE(SMBgetatr);
 
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status);
+       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBgetatr);
                return ERROR_NT(status);
@@ -611,6 +635,10 @@ int reply_getatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                ok = True;
        } else {
                unix_convert(fname,conn,0,&bad_path,&sbuf);
+               if (bad_path) {
+                       END_PROFILE(SMBgetatr);
+                       return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+               }
                if (check_name(fname,conn)) {
                        if (VALID_STAT(sbuf) || SMB_VFS_STAT(conn,fname,&sbuf) == 0) {
                                mode = dos_mode(conn,fname,&sbuf);
@@ -667,13 +695,17 @@ int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        START_PROFILE(SMBsetatr);
 
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status);
+       p += srvstr_get_path(inbuf, fname, p, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBsetatr);
                return ERROR_NT(status);
        }
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBsetatr);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
 
        mode = SVAL(inbuf,smb_vwv0);
        mtime = make_unix_date3(inbuf+smb_vwv1);
@@ -684,8 +716,9 @@ int reply_setatr(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                else
                        mode &= ~aDIR;
 
-               if (check_name(fname,conn))
-                       ok =  (file_chmod(conn,fname,mode,NULL) == 0);
+               if (check_name(fname,conn)) {
+                       ok = (file_set_dosmode(conn,fname,mode,&sbuf,False) == 0);
+               }
        } else {
                ok = True;
        }
@@ -795,7 +828,7 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        maxentries = SVAL(inbuf,smb_vwv0); 
        dirtype = SVAL(inbuf,smb_vwv1);
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &nt_status);
+       p += srvstr_get_path(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &nt_status, True);
        if (!NT_STATUS_IS_OK(nt_status)) {
                END_PROFILE(SMBsearch);
                return ERROR_NT(nt_status);
@@ -866,7 +899,7 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                                END_PROFILE(SMBsearch);
                                return ERROR_DOS(ERRDOS,ERRnofids);
                        }
-                       dptr_set_wcard(dptr_num, strdup(mask));
+                       dptr_set_wcard(dptr_num, SMB_STRDUP(mask));
                        dptr_set_attr(dptr_num, dirtype);
                } else {
                        dirtype = dptr_attr(dptr_num);
@@ -900,8 +933,8 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                                                make_dir_struct(p,mask,fname,size,mode,date);
                                                dptr_fill(p+12,dptr_num);
                                                numentries++;
+                                               p += DIR_STRUCT_SIZE;
                                        }
-                                       p += DIR_STRUCT_SIZE;
                                }
                        }
                } /* if (ok ) */
@@ -914,24 +947,21 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                and no entries were found then return error and close dirptr 
                (X/Open spec) */
 
-       if(ok && expect_close && numentries == 0 && status_len == 0) {
-               if (Protocol < PROTOCOL_NT1) {
-                       SCVAL(outbuf,smb_rcls,ERRDOS);
-                       SSVAL(outbuf,smb_err,ERRnofiles);
-               }
-               /* Also close the dptr - we know it's gone */
+       if (numentries == 0 || !ok) {
                dptr_close(&dptr_num);
-       } else if (numentries == 0 || !ok) {
-               if (Protocol < PROTOCOL_NT1) {
-                       SCVAL(outbuf,smb_rcls,ERRDOS);
-                       SSVAL(outbuf,smb_err,ERRnofiles);
-               }
+       } else if(ok && expect_close && status_len == 0) {
+               /* Close the dptr - we know it's gone */
                dptr_close(&dptr_num);
        }
 
        /* If we were called as SMBfunique, then we can close the dirptr now ! */
-       if(dptr_num >= 0 && CVAL(inbuf,smb_com) == SMBfunique)
+       if(dptr_num >= 0 && CVAL(inbuf,smb_com) == SMBfunique) {
                dptr_close(&dptr_num);
+       }
+
+       if ((numentries == 0) && !ms_has_wild(mask)) {
+               return ERROR_BOTH(STATUS_NO_MORE_FILES,ERRDOS,ERRnofiles);
+       }
 
        SSVAL(outbuf,smb_vwv0,numentries);
        SSVAL(outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
@@ -973,7 +1003,7 @@ int reply_fclose(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 
        outsize = set_message(outbuf,1,0,True);
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &err);
+       p += srvstr_get_path(inbuf, path, p, sizeof(path), 0, STR_TERMINATE, &err, True);
        if (!NT_STATUS_IS_OK(err)) {
                END_PROFILE(SMBfclose);
                return ERROR_NT(err);
@@ -1014,18 +1044,18 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        int share_mode;
        SMB_OFF_T size = 0;
        time_t mtime=0;
-       mode_t unixmode;
        int rmode=0;
        SMB_STRUCT_STAT sbuf;
        BOOL bad_path = False;
        files_struct *fsp;
        int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
+       uint16 dos_attr = SVAL(inbuf,smb_vwv1);
        NTSTATUS status;
        START_PROFILE(SMBopen);
  
        share_mode = SVAL(inbuf,smb_vwv0);
 
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBopen);
                return ERROR_NT(status);
@@ -1034,14 +1064,21 @@ int reply_open(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBopen);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
     
-       unixmode = unix_mode(conn,aARCH,fname);
-      
        fsp = open_file_shared(conn,fname,&sbuf,share_mode,(FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),
-                       unixmode, oplock_request,&rmode,NULL);
+                       (uint32)dos_attr, oplock_request,&rmode,NULL);
 
        if (!fsp) {
                END_PROFILE(SMBopen);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       clear_cached_errors();
+                       return -1;
+               }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
 
@@ -1095,7 +1132,6 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        uint32 smb_time = make_unix_date3(inbuf+smb_vwv6);
 #endif
        int smb_ofun = SVAL(inbuf,smb_vwv8);
-       mode_t unixmode;
        SMB_OFF_T size=0;
        int fmode=0,mtime=0,rmode=0;
        SMB_STRUCT_STAT sbuf;
@@ -1117,7 +1153,7 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        }
 
        /* XXXX we need to handle passed times, sattr and flags */
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf), sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBopenX);
                return ERROR_NT(status);
@@ -1126,14 +1162,21 @@ int reply_open_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
        RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBopenX);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
     
-       unixmode = unix_mode(conn,smb_attr | aARCH, fname);
-      
-       fsp = open_file_shared(conn,fname,&sbuf,smb_mode,smb_ofun,unixmode,
+       fsp = open_file_shared(conn,fname,&sbuf,smb_mode,smb_ofun,(uint32)smb_attr,
                        oplock_request, &rmode,&smb_action);
       
        if (!fsp) {
                END_PROFILE(SMBopenX);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       clear_cached_errors();
+                       return -1;
+               }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
 
@@ -1221,7 +1264,6 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        int com;
        int outsize = 0;
        int createmode;
-       mode_t unixmode;
        int ofun = 0;
        BOOL bad_path = False;
        files_struct *fsp;
@@ -1233,7 +1275,7 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        com = SVAL(inbuf,smb_com);
 
        createmode = SVAL(inbuf,smb_vwv0);
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf) + 1, sizeof(fname), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf) + 1, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcreate);
                return ERROR_NT(status);
@@ -1242,12 +1284,14 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBcreate);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
 
        if (createmode & aVOLID)
                DEBUG(0,("Attempt to create file (%s) with volid set - please report this\n",fname));
   
-       unixmode = unix_mode(conn,createmode,fname);
-  
        if(com == SMBmknew) {
                /* We should fail if file exists. */
                ofun = FILE_CREATE_IF_NOT_EXIST;
@@ -1258,10 +1302,15 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 
        /* Open file in dos compatibility share mode. */
        fsp = open_file_shared(conn,fname,&sbuf,SET_DENY_MODE(DENY_FCB)|SET_OPEN_MODE(DOS_OPEN_FCB), 
-                       ofun, unixmode, oplock_request, NULL, NULL);
+                       ofun, (uint32)createmode, oplock_request, NULL, NULL);
   
        if (!fsp) {
                END_PROFILE(SMBcreate);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       clear_cached_errors();
+                       return -1;
+               }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
  
@@ -1275,7 +1324,7 @@ int reply_mknew(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
  
        DEBUG( 2, ( "new file %s\n", fname ) );
-       DEBUG( 3, ( "mknew %s fd=%d dmode=%d umode=%o\n", fname, fsp->fd, createmode, (int)unixmode ) );
+       DEBUG( 3, ( "mknew %s fd=%d dmode=%d\n", fname, fsp->fd, createmode ) );
 
        END_PROFILE(SMBcreate);
        return(outsize);
@@ -1289,8 +1338,7 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 {
        pstring fname;
        int outsize = 0;
-       int createmode;
-       mode_t unixmode;
+       int createattr;
        BOOL bad_path = False;
        files_struct *fsp;
        int oplock_request = CORE_OPLOCK_REQUEST(inbuf);
@@ -1298,22 +1346,29 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        SMB_STRUCT_STAT sbuf;
        char *p, *s;
        NTSTATUS status;
+       unsigned int namelen;
 
        START_PROFILE(SMBctemp);
 
-       createmode = SVAL(inbuf,smb_vwv0);
-       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status);
+       createattr = SVAL(inbuf,smb_vwv0);
+       srvstr_get_path(inbuf, fname, smb_buf(inbuf)+1, sizeof(fname), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBctemp);
                return ERROR_NT(status);
        }
-       pstrcat(fname,"\\TMXXXXXX");
+       if (*fname) {
+               pstrcat(fname,"/TMXXXXXX");
+       } else {
+               pstrcat(fname,"TMXXXXXX");
+       }
 
        RESOLVE_DFSPATH(fname, conn, inbuf, outbuf);
 
        unix_convert(fname,conn,0,&bad_path,&sbuf);
-  
-       unixmode = unix_mode(conn,createmode,fname);
+       if (bad_path) {
+               END_PROFILE(SMBctemp);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
   
        tmpfd = smb_mkstemp(fname);
        if (tmpfd == -1) {
@@ -1328,13 +1383,18 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        fsp = open_file_shared(conn,fname,&sbuf,
                SET_DENY_MODE(DENY_FCB)|SET_OPEN_MODE(DOS_OPEN_FCB),
                FILE_EXISTS_OPEN|FILE_FAIL_IF_NOT_EXIST,
-               unixmode, oplock_request, NULL, NULL);
+               (uint32)createattr, oplock_request, NULL, NULL);
 
        /* close fd from smb_mkstemp() */
        close(tmpfd);
 
        if (!fsp) {
                END_PROFILE(SMBctemp);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       clear_cached_errors();
+                       return -1;
+               }
                return set_bad_path_error(errno, bad_path, outbuf, ERRDOS, ERRnoaccess);
        }
 
@@ -1349,10 +1409,13 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                s++;
 
        p = smb_buf(outbuf);
+#if 0
+       /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
+          thing in the byte section. JRA */
        SSVALS(p, 0, -1); /* what is this? not in spec */
-       SSVAL(p, 2, strlen(s));
-       p += 4;
-       p += srvstr_push(outbuf, p, s, -1, STR_ASCII);
+#endif
+       namelen = srvstr_push(outbuf, p, s, -1, STR_ASCII|STR_TERMINATE);
+       p += namelen;
        outsize = set_message_end(outbuf, p);
 
        if (oplock_request && lp_fake_oplocks(SNUM(conn)))
@@ -1362,8 +1425,8 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                SCVAL(outbuf,smb_flg,CVAL(outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
 
        DEBUG( 2, ( "created temp file %s\n", fname ) );
-       DEBUG( 3, ( "ctemp %s fd=%d dmode=%d umode=%o\n",
-                       fname, fsp->fd, createmode, (int)unixmode ) );
+       DEBUG( 3, ( "ctemp %s fd=%d umode=%o\n",
+                       fname, fsp->fd, sbuf.st_mode ) );
 
        END_PROFILE(SMBctemp);
        return(outsize);
@@ -1373,15 +1436,20 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
  Check if a user is allowed to rename a file.
 ********************************************************************/
 
-static NTSTATUS can_rename(char *fname,connection_struct *conn, SMB_STRUCT_STAT *pst)
+static NTSTATUS can_rename(char *fname,connection_struct *conn, uint16 dirtype, SMB_STRUCT_STAT *pst)
 {
        int smb_action;
        int access_mode;
        files_struct *fsp;
+       uint16 fmode;
 
        if (!CAN_WRITE(conn))
                return NT_STATUS_MEDIA_WRITE_PROTECTED;
-       
+
+       fmode = dos_mode(conn,fname,pst);
+       if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM))
+               return NT_STATUS_NO_SUCH_FILE;
+
        if (S_ISDIR(pst->st_mode))
                return NT_STATUS_OK;
 
@@ -1390,7 +1458,7 @@ static NTSTATUS can_rename(char *fname,connection_struct *conn, SMB_STRUCT_STAT
        unix_ERR_code = 0;
 
        fsp = open_file_shared1(conn, fname, pst, DELETE_ACCESS, SET_DENY_MODE(DENY_ALL),
-               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), 0, 0, &access_mode, &smb_action);
+               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, 0, &access_mode, &smb_action);
 
        if (!fsp) {
                NTSTATUS ret = NT_STATUS_ACCESS_DENIED;
@@ -1455,7 +1523,7 @@ static NTSTATUS can_delete(char *fname,connection_struct *conn, int dirtype, BOO
        unix_ERR_code = 0;
 
        fsp = open_file_shared1(conn, fname, &sbuf, DELETE_ACCESS, SET_DENY_MODE(DENY_ALL),
-               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), 0, 0, &access_mode, &smb_action);
+               (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, 0, &access_mode, &smb_action);
 
        if (!fsp) {
                NTSTATUS ret = NT_STATUS_ACCESS_DENIED;
@@ -1523,7 +1591,7 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
         */
        
        if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask );
+               mangle_check_cache( mask, sizeof(pstring)-1 );
        
        if (!has_wild) {
                pstrcat(directory,"/");
@@ -1548,12 +1616,13 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
                */
                
                if (dirptr) {
+                       long offset = 0;
                        error = NT_STATUS_NO_SUCH_FILE;
-                       
+
                        if (strequal(mask,"????????.???"))
                                pstrcpy(mask,"*");
 
-                       while ((dname = ReadDirName(dirptr))) {
+                       while ((dname = ReadDirName(dirptr, &offset))) {
                                pstring fname;
                                BOOL sys_direntry = False;
                                pstrcpy(fname,dname);
@@ -1561,7 +1630,7 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
                                /* Quick check for "." and ".." */
                                if (fname[0] == '.') {
                                        if (!fname[1] || (fname[1] == '.' && !fname[2])) {
-                                               if ((dirtype & aDIR)) {
+                                               if ((dirtype & FILE_ATTRIBUTE_DIRECTORY) && (dirtype & FILE_ATTRIBUTE_SYSTEM)) {
                                                        sys_direntry = True;
                                                } else {
                                                        continue;
@@ -1569,18 +1638,21 @@ NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
                                        }
                                }
 
-                               if(!mask_match(fname, mask, case_sensitive))
+                               if(!mask_match(fname, mask, conn->case_sensitive))
                                        continue;
                                
                                if (sys_direntry) {
                                        error = NT_STATUS_OBJECT_NAME_INVALID;
-                                       continue;
+                                       DEBUG(3,("unlink_internals: system directory delete denied [%s] mask [%s]\n",
+                                               fname, mask));
+                                       break;
                                }
 
                                slprintf(fname,sizeof(fname)-1, "%s/%s",directory,dname);
                                error = can_delete(fname,conn,dirtype,bad_path);
-                               if (!NT_STATUS_IS_OK(error))
+                               if (!NT_STATUS_IS_OK(error)) {
                                        continue;
+                               }
                                if (SMB_VFS_UNLINK(conn,fname) == 0)
                                        count++;
                                DEBUG(3,("unlink_internals: succesful unlink [%s]\n",fname));
@@ -1611,7 +1683,7 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        
        dirtype = SVAL(inbuf,smb_vwv0);
        
-       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, name, smb_buf(inbuf) + 1, sizeof(name), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBunlink);
                return ERROR_NT(status);
@@ -1622,8 +1694,14 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
        DEBUG(3,("reply_unlink : %s\n",name));
        
        status = unlink_internals(conn, dirtype, name);
-       if (!NT_STATUS_IS_OK(status))
+       if (!NT_STATUS_IS_OK(status)) {
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       clear_cached_errors();
+                       return -1;
+               }
                return ERROR_NT(status);
+       }
 
        /*
         * Win2k needs a changenotify request response before it will
@@ -1641,7 +1719,7 @@ int reply_unlink(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
  Fail for readbraw.
 ****************************************************************************/
 
-void fail_readraw(void)
+static void fail_readraw(void)
 {
        pstring errstr;
        slprintf(errstr, sizeof(errstr)-1, "FAIL ! reply_readbraw: socket write fail (%s)",
@@ -1649,23 +1727,58 @@ void fail_readraw(void)
        exit_server(errstr);
 }
 
+#if defined(WITH_SENDFILE)
+/****************************************************************************
+ Fake (read/write) sendfile. Returns -1 on read or write fail.
+****************************************************************************/
+
+static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread, char *buf, int bufsize)
+{
+       ssize_t ret=0;
+
+       /* Paranioa check... */
+       if (nread > bufsize) {
+               fail_readraw();
+       }
+
+       if (nread > 0) {
+               ret = read_file(fsp,buf,startpos,nread);
+               if (ret == -1) {
+                       return -1;
+               }
+       }
+
+       /* If we had a short read, fill with zeros. */
+       if (ret < nread) {
+               memset(buf, '\0', nread - ret);
+       }
+
+       if (write_data(smbd_server_fd(),buf,nread) != nread) {
+               return -1;
+       }       
+
+       return (ssize_t)nread;
+}
+#endif
+
 /****************************************************************************
  Use sendfile in readbraw.
 ****************************************************************************/
 
 void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T startpos, size_t nread,
-               ssize_t mincount, char *outbuf)
+               ssize_t mincount, char *outbuf, int out_buffsize)
 {
        ssize_t ret=0;
 
 #if defined(WITH_SENDFILE)
        /*
-        * We can only use sendfile on a non-chained packet and on a file
-        * that is exclusively oplocked. reply_readbraw has already checked the length.
+        * We can only use sendfile on a non-chained packet 
+        * but we can use on a non-oplocked file. tridge proved this
+        * on a train in Germany :-). JRA.
+        * reply_readbraw has already checked the length.
         */
 
-       if ((nread > 0) && (lp_write_cache_size(SNUM(conn)) == 0) &&
-                       EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type) && lp_use_sendfile(SNUM(conn)) ) {
+       if (chain_size ==0 && (nread > 0) && (lp_write_cache_size(SNUM(conn)) == 0) && lp_use_sendfile(SNUM(conn)) ) {
                DATA_BLOB header;
 
                _smb_setlen(outbuf,nread);
@@ -1674,12 +1787,28 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
                header.free = NULL;
 
                if ( SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fd, &header, startpos, nread) == -1) {
+                       /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
+                       if (errno == ENOSYS) {
+                               goto normal_readbraw;
+                       }
+
                        /*
-                        * Special hack for broken Linux with no 64 bit clean sendfile. If we
-                        * return ENOSYS then pretend we just got a normal read.
+                        * Special hack for broken Linux with no working sendfile. If we
+                        * return EINTR we sent the header but not the rest of the data.
+                        * Fake this up by doing read/write calls.
                         */
-                       if (errno == ENOSYS)
-                               goto normal_read;
+                       if (errno == EINTR) {
+                               /* Ensure we don't do this again. */
+                               set_use_sendfile(SNUM(conn), False);
+                               DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
+
+                               if (fake_sendfile(fsp, startpos, nread, outbuf + 4, out_buffsize - 4) == -1) {
+                                       DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
+                                               fsp->fsp_name, strerror(errno) ));
+                                       exit_server("send_file_readbraw fake_sendfile failed");
+                               }
+                               return;
+                       }
 
                        DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
                                fsp->fsp_name, strerror(errno) ));
@@ -1688,7 +1817,8 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
 
        }
 
-  normal_read:
+  normal_readbraw:
+
 #endif
 
        if (nread > 0) {
@@ -1711,7 +1841,7 @@ void send_file_readbraw(connection_struct *conn, files_struct *fsp, SMB_OFF_T st
  Reply to a readbraw (core+ protocol).
 ****************************************************************************/
 
-int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_size, int dum_buffsize)
+int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_size, int out_buffsize)
 {
        extern struct current_user current_user;
        ssize_t maxcount,mincount;
@@ -1800,7 +1930,7 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s
        /* ensure we don't overrun the packet size */
        maxcount = MIN(65535,maxcount);
 
-       if (!is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK,False)) {
+       if (!is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                SMB_OFF_T size = fsp->size;
                SMB_OFF_T sizeneeded = startpos + maxcount;
   
@@ -1826,7 +1956,7 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s
        DEBUG( 3, ( "readbraw fnum=%d start=%.0f max=%d min=%d nread=%d\n", fsp->fnum, (double)startpos,
                                (int)maxcount, (int)mincount, (int)nread ) );
   
-       send_file_readbraw(conn, fsp, startpos, nread, mincount, outbuf);
+       send_file_readbraw(conn, fsp, startpos, nread, mincount, outbuf, out_buffsize);
 
        DEBUG(5,("readbraw finished\n"));
        END_PROFILE(SMBreadbraw);
@@ -1960,7 +2090,7 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
 
        data = smb_buf(outbuf) + 3;
   
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtoread,(SMB_BIG_UINT)startpos, READ_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtoread,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                END_PROFILE(SMBread);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -1990,20 +2120,22 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
  Reply to a read and X - possibly using sendfile.
 ****************************************************************************/
 
-int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length, 
+int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length, int len_outbuf,
                files_struct *fsp, SMB_OFF_T startpos, size_t smb_maxcnt)
 {
+       int outsize = 0;
        ssize_t nread = -1;
        char *data = smb_buf(outbuf);
 
 #if defined(WITH_SENDFILE)
        /*
-        * We can only use sendfile on a non-chained packet and on a file
-        * that is exclusively oplocked.
+        * We can only use sendfile on a non-chained packet 
+        * but we can use on a non-oplocked file. tridge proved this
+        * on a train in Germany :-). JRA.
         */
 
-       if ((CVAL(inbuf,smb_vwv0) == 0xFF) && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type) &&
-                       lp_use_sendfile(SNUM(conn)) && (lp_write_cache_size(SNUM(conn)) == 0) ) {
+       if (chain_size ==0 && (CVAL(inbuf,smb_vwv0) == 0xFF) && lp_use_sendfile(SNUM(conn)) &&
+                       (lp_write_cache_size(SNUM(conn)) == 0) ) {
                SMB_STRUCT_STAT sbuf;
                DATA_BLOB header;
 
@@ -2028,6 +2160,7 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
                SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
                SSVAL(outbuf,smb_vwv5,smb_maxcnt);
                SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
+               SSVAL(outbuf,smb_vwv7,((smb_maxcnt >> 16) & 1));
                SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
                SCVAL(outbuf,smb_vwv0,0xFF);
                set_message(outbuf,12,smb_maxcnt,False);
@@ -2035,13 +2168,34 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
                header.length = data - outbuf;
                header.free = NULL;
 
-               if ( SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fd, &header, startpos, smb_maxcnt) == -1) {
+               if ((nread = SMB_VFS_SENDFILE( smbd_server_fd(), fsp, fsp->fd, &header, startpos, smb_maxcnt)) == -1) {
+                       /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
+                       if (errno == ENOSYS) {
+                               goto normal_read;
+                       }
+
                        /*
-                        * Special hack for broken Linux with no 64 bit clean sendfile. If we
-                        * return ENOSYS then pretend we just got a normal read.
+                        * Special hack for broken Linux with no working sendfile. If we
+                        * return EINTR we sent the header but not the rest of the data.
+                        * Fake this up by doing read/write calls.
                         */
-                       if (errno == ENOSYS)
-                               goto normal_read;
+
+                       if (errno == EINTR) {
+                               /* Ensure we don't do this again. */
+                               set_use_sendfile(SNUM(conn), False);
+                               DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
+
+                               if ((nread = fake_sendfile(fsp, startpos, smb_maxcnt, data,
+                                                       len_outbuf - (data-outbuf))) == -1) {
+                                       DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
+                                               fsp->fsp_name, strerror(errno) ));
+                                       exit_server("send_file_readX: fake_sendfile failed");
+                               }
+                               DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
+                                       fsp->fnum, (int)smb_maxcnt, (int)nread ) );
+                               /* Returning -1 here means successful sendfile. */
+                               return -1;
+                       }
 
                        DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
                                fsp->fsp_name, strerror(errno) ));
@@ -2050,6 +2204,7 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
 
                DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
                        fsp->fnum, (int)smb_maxcnt, (int)nread ) );
+               /* Returning -1 here means successful sendfile. */
                return -1;
        }
 
@@ -2064,15 +2219,18 @@ int send_file_readX(connection_struct *conn, char *inbuf,char *outbuf,int length
                return(UNIXERROR(ERRDOS,ERRnoaccess));
        }
 
+       outsize = set_message(outbuf,12,nread,False);
        SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
        SSVAL(outbuf,smb_vwv5,nread);
        SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
+       SSVAL(outbuf,smb_vwv7,((nread >> 16) & 1));
        SSVAL(smb_buf(outbuf),-2,nread);
   
        DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
                fsp->fnum, (int)smb_maxcnt, (int)nread ) );
 
-       return nread;
+       /* Returning the number of bytes we want to send back - including header. */
+       return outsize;
 }
 
 /****************************************************************************
@@ -2102,6 +2260,18 @@ int reply_read_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
 
        set_message(outbuf,12,0,True);
 
+       if (global_client_caps & CAP_LARGE_READX) {
+               if (SVAL(inbuf,smb_vwv7) == 1) {
+                       smb_maxcnt |= (1<<16);
+               }
+               if (smb_maxcnt > BUFFER_SIZE) {
+                       DEBUG(0,("reply_read_and_X - read too large (%u) for reply buffer %u\n",
+                               (unsigned int)smb_maxcnt, (unsigned int)BUFFER_SIZE));
+                       END_PROFILE(SMBreadX);
+                       return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               }
+       }
+
        if(CVAL(inbuf,smb_wct) == 12) {
 #ifdef LARGE_SMB_OFF_T
                /*
@@ -2126,12 +2296,12 @@ int reply_read_and_X(connection_struct *conn, char *inbuf,char *outbuf,int lengt
 
        }
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)smb_maxcnt,(SMB_BIG_UINT)startpos, READ_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)smb_maxcnt,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                END_PROFILE(SMBreadX);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
 
-       nread = send_file_readX(conn, inbuf, outbuf, length, fsp, startpos, smb_maxcnt);
+       nread = send_file_readX(conn, inbuf, outbuf, length, bufsize, fsp, startpos, smb_maxcnt);
        if (nread != -1)
                nread = chain_reply(inbuf,outbuf,length,bufsize);
 
@@ -2182,7 +2352,7 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int size,
        SCVAL(inbuf,smb_com,SMBwritec);
        SCVAL(outbuf,smb_com,SMBwritec);
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwritebraw);
                return(ERROR_DOS(ERRDOS,ERRlock));
        }
@@ -2297,8 +2467,7 @@ int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf,
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
        data = smb_buf(inbuf) + 3;
   
-       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, 
-                     WRITE_LOCK,False)) {
+       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwriteunlock);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2366,7 +2535,7 @@ int reply_write(connection_struct *conn, char *inbuf,char *outbuf,int size,int d
        startpos = IVAL_TO_SMB_OFF_T(inbuf,smb_vwv2);
        data = smb_buf(inbuf) + 3;
   
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwrite);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2477,7 +2646,7 @@ int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int leng
 #endif /* LARGE_SMB_OFF_T */
        }
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwriteX);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -2748,7 +2917,7 @@ int reply_writeclose(connection_struct *conn,
        mtime = make_unix_date3(inbuf+smb_vwv4);
        data = smb_buf(inbuf) + 1;
   
-       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK,False)) {
+       if (numtowrite && is_locked(fsp,conn,(SMB_BIG_UINT)numtowrite,(SMB_BIG_UINT)startpos, WRITE_LOCK)) {
                END_PROFILE(SMBwriteclose);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -3137,15 +3306,16 @@ NTSTATUS mkdir_internal(connection_struct *conn, pstring directory)
                return NT_STATUS_OBJECT_NAME_INVALID;
        }
 
+       if (bad_path) {
+               return NT_STATUS_OBJECT_PATH_NOT_FOUND;
+       }
+
        if (check_name(directory, conn))
-               ret = vfs_MkDir(conn,directory,unix_mode(conn,aDIR,directory));
+               ret = vfs_MkDir(conn,directory,unix_mode(conn,aDIR,directory,True));
        
        if (ret == -1) {
                if(errno == ENOENT) {
-                       if (bad_path)
-                               return NT_STATUS_OBJECT_PATH_NOT_FOUND;
-                       else
-                               return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+                       return NT_STATUS_OBJECT_NAME_NOT_FOUND;
                }
                return map_nt_error_from_unix(errno);
        }
@@ -3164,7 +3334,7 @@ int reply_mkdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        NTSTATUS status;
        START_PROFILE(SMBmkdir);
  
-       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmkdir);
                return ERROR_NT(status);
@@ -3195,12 +3365,13 @@ static BOOL recursive_rmdir(connection_struct *conn, char *directory)
 {
        const char *dname = NULL;
        BOOL ret = False;
+       long offset = 0;
        void *dirptr = OpenDir(conn, directory, False);
 
        if(dirptr == NULL)
                return True;
 
-       while((dname = ReadDirName(dirptr))) {
+       while((dname = ReadDirName(dirptr, &offset))) {
                pstring fullname;
                SMB_STRUCT_STAT st;
 
@@ -3262,8 +3433,8 @@ BOOL rmdir_internals(connection_struct *conn, char *directory)
                void *dirptr = OpenDir(conn, directory, False);
 
                if(dirptr != NULL) {
-                       int dirpos = TellDir(dirptr);
-                       while ((dname = ReadDirName(dirptr))) {
+                       long dirpos = TellDir(dirptr);
+                       while ((dname = ReadDirName(dirptr,&dirpos))) {
                                if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
                                        continue;
                                if(!IS_VETO_PATH(conn, dname)) {
@@ -3274,7 +3445,7 @@ BOOL rmdir_internals(connection_struct *conn, char *directory)
 
                        if(all_veto_files) {
                                SeekDir(dirptr,dirpos);
-                               while ((dname = ReadDirName(dirptr))) {
+                               while ((dname = ReadDirName(dirptr,&dirpos))) {
                                        pstring fullname;
                                        SMB_STRUCT_STAT st;
 
@@ -3334,7 +3505,7 @@ int reply_rmdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        NTSTATUS status;
        START_PROFILE(SMBrmdir);
 
-       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, directory, smb_buf(inbuf) + 1, sizeof(directory), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBrmdir);
                return ERROR_NT(status);
@@ -3343,6 +3514,10 @@ int reply_rmdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        RESOLVE_DFSPATH(directory, conn, inbuf, outbuf)
 
        unix_convert(directory,conn, NULL,&bad_path,&sbuf);
+       if (bad_path) {
+               END_PROFILE(SMBrmdir);
+               return ERROR_NT(NT_STATUS_OBJECT_PATH_NOT_FOUND);
+       }
   
        if (check_name(directory,conn)) {
                dptr_closepath(directory,SVAL(inbuf,smb_pid));
@@ -3407,6 +3582,9 @@ static BOOL resolve_wildcards(const char *name1, char *name2)
                if (*p2 == '?') {
                        *p2 = *p;
                        p2++;
+               } else if (*p2 == '*') {
+                       pstrcpy(p2, p);
+                       break;
                } else {
                        p2++;
                }
@@ -3420,6 +3598,9 @@ static BOOL resolve_wildcards(const char *name1, char *name2)
                if (*p2 == '?') {
                        *p2 = *p;
                        p2++;
+               } else if (*p2 == '*') {
+                       pstrcpy(p2, p);
+                       break;
                } else {
                        p2++;
                }
@@ -3468,7 +3649,7 @@ static void rename_open_files(connection_struct *conn, SMB_DEV_T dev, SMB_INO_T
  Rename an open file - given an fsp.
 ****************************************************************************/
 
-NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *newname, BOOL replace_if_exists)
+NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *newname, uint16 attrs, BOOL replace_if_exists)
 {
        SMB_STRUCT_STAT sbuf;
        BOOL bad_path = False;
@@ -3507,7 +3688,7 @@ NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *
         * filename).
         */
 
-       if((case_sensitive == False) && (case_preserve == True) &&
+       if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
                        strequal(newname, fsp->fsp_name)) {
                char *p;
                pstring newname_modified_last_component;
@@ -3549,7 +3730,7 @@ NTSTATUS rename_internals_fsp(connection_struct *conn, files_struct *fsp, char *
                return NT_STATUS_OBJECT_NAME_COLLISION;
        }
 
-       error = can_rename(newname,conn,&sbuf);
+       error = can_rename(newname,conn,attrs,&sbuf);
 
        if (dest_exists && !NT_STATUS_IS_OK(error)) {
                DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
@@ -3656,7 +3837,7 @@ NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, ui
         */
 
        if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask );
+               mangle_check_cache( mask, sizeof(pstring)-1 );
 
        has_wild = ms_has_wild(mask);
 
@@ -3681,7 +3862,7 @@ NTSTATUS rename_internals(connection_struct *conn, char *name, char *newname, ui
                
                DEBUG(3,("rename_internals: case_sensitive = %d, case_preserve = %d, short case preserve = %d, \
 directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n", 
-                        case_sensitive, case_preserve, short_case_preserve, directory, 
+                        conn->case_sensitive, conn->case_preserve, conn->short_case_preserve, directory, 
                         newname, last_component_dest, is_short_name));
 
                /*
@@ -3692,10 +3873,10 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                 * the rename (user is trying to change the case of the
                 * filename).
                 */
-               if((case_sensitive == False) && 
-                  (((case_preserve == True) && 
+               if((conn->case_sensitive == False) && 
+                  (((conn->case_preserve == True) && 
                     (is_short_name == False)) || 
-                   ((short_case_preserve == True) && 
+                   ((conn->short_case_preserve == True) && 
                     (is_short_name == True))) &&
                   strcsequal(directory, newname)) {
                        pstring modified_last_component;
@@ -3755,7 +3936,7 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                        return NT_STATUS_OBJECT_PATH_NOT_FOUND;
                }
 
-               error = can_rename(directory,conn,&sbuf1);
+               error = can_rename(directory,conn,attrs,&sbuf1);
 
                if (!NT_STATUS_IS_OK(error)) {
                        DEBUG(3,("rename_internals: Error %s rename %s -> %s\n",
@@ -3808,13 +3989,14 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                        dirptr = OpenDir(conn, directory, True);
                
                if (dirptr) {
+                       long offset = 0;
                        error = NT_STATUS_NO_SUCH_FILE;
 /*                     Was error = NT_STATUS_OBJECT_NAME_NOT_FOUND; - gentest fix. JRA */
                        
                        if (strequal(mask,"????????.???"))
                                pstrcpy(mask,"*");
                        
-                       while ((dname = ReadDirName(dirptr))) {
+                       while ((dname = ReadDirName(dirptr, &offset))) {
                                pstring fname;
                                BOOL sysdir_entry = False;
 
@@ -3831,12 +4013,12 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                                        }
                                }
 
-                               if(!mask_match(fname, mask, case_sensitive))
+                               if(!mask_match(fname, mask, conn->case_sensitive))
                                        continue;
                                
                                if (sysdir_entry) {
                                        error = NT_STATUS_OBJECT_NAME_INVALID;
-                                       continue;
+                                       break;
                                }
 
                                error = NT_STATUS_ACCESS_DENIED;
@@ -3846,7 +4028,7 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                                        DEBUG(6,("rename %s failed. Error %s\n", fname, nt_errstr(error)));
                                        continue;
                                }
-                               error = can_rename(fname,conn,&sbuf1);
+                               error = can_rename(fname,conn,attrs,&sbuf1);
                                if (!NT_STATUS_IS_OK(error)) {
                                        DEBUG(6,("rename %s refused\n", fname));
                                        continue;
@@ -3859,6 +4041,14 @@ directory = %s, newname = %s, last_component_dest = %s, is_8_3 = %d\n",
                                        continue;
                                }
                                
+                               if (strcsequal(fname,destname)) {
+                                       rename_open_files(conn, sbuf1.st_dev, sbuf1.st_ino, newname);
+                                       DEBUG(3,("rename_internals: identical names in wildcard rename %s - success\n", fname));
+                                       count++;
+                                       error = NT_STATUS_OK;
+                                       continue;
+                               }
+
                                if (!replace_if_exists && 
                                     vfs_file_exist(conn,destname, NULL)) {
                                        DEBUG(6,("file_exist %s\n", destname));
@@ -3909,13 +4099,13 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        START_PROFILE(SMBmv);
 
        p = smb_buf(inbuf) + 1;
-       p += srvstr_get_path(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status);
+       p += srvstr_get_path(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmv);
                return ERROR_NT(status);
        }
        p++;
-       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status);
+       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmv);
                return ERROR_NT(status);
@@ -3929,6 +4119,11 @@ int reply_mv(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        status = rename_internals(conn, name, newname, attrs, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBmv);
+               if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+                       /* We have re-scheduled this call. */
+                       clear_cached_errors();
+                       return -1;
+               }
                return ERROR_NT(status);
        }
 
@@ -3955,7 +4150,8 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
        SMB_OFF_T ret=-1;
        files_struct *fsp1,*fsp2;
        pstring dest;
-  
+       uint32 dosattrs;
        *err_ret = 0;
 
        pstrcpy(dest,dest1);
@@ -3973,7 +4169,8 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
                return(False);
 
        fsp1 = open_file_shared(conn,src,&src_sbuf,SET_DENY_MODE(DENY_NONE)|SET_OPEN_MODE(DOS_OPEN_RDONLY),
-                                       (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),0,0,&Access,&action);
+                                       (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN),FILE_ATTRIBUTE_NORMAL,INTERNAL_OPEN_ONLY,
+                                       &Access,&action);
 
        if (!fsp1)
                return(False);
@@ -3981,11 +4178,12 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
        if (!target_is_directory && count)
                ofun = FILE_EXISTS_OPEN;
 
+       dosattrs = dos_mode(conn, src, &src_sbuf);
        if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1)
                ZERO_STRUCTP(&sbuf2);
 
        fsp2 = open_file_shared(conn,dest,&sbuf2,SET_DENY_MODE(DENY_NONE)|SET_OPEN_MODE(DOS_OPEN_WRONLY),
-                       ofun,src_sbuf.st_mode,0,&Access,&action);
+                       ofun,dosattrs,INTERNAL_OPEN_ONLY,&Access,&action);
 
        if (!fsp2) {
                close_file(fsp1,False);
@@ -4053,12 +4251,12 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
        *directory = *mask = 0;
 
        p = smb_buf(inbuf);
-       p += srvstr_get_path(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status);
+       p += srvstr_get_path(inbuf, name, p, sizeof(name), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcopy);
                return ERROR_NT(status);
        }
-       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status);
+       p += srvstr_get_path(inbuf, newname, p, sizeof(newname), 0, STR_TERMINATE, &status, True);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(SMBcopy);
                return ERROR_NT(status);
@@ -4118,7 +4316,7 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
         */
 
        if (!rc && mangle_is_mangled(mask))
-               mangle_check_cache( mask );
+               mangle_check_cache( mask, sizeof(pstring)-1 );
 
        has_wild = ms_has_wild(mask);
 
@@ -4145,16 +4343,17 @@ int reply_copy(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
                        dirptr = OpenDir(conn, directory, True);
 
                if (dirptr) {
+                       long offset = 0;
                        error = ERRbadfile;
 
                        if (strequal(mask,"????????.???"))
                                pstrcpy(mask,"*");
 
-                       while ((dname = ReadDirName(dirptr))) {
+                       while ((dname = ReadDirName(dirptr, &offset))) {
                                pstring fname;
                                pstrcpy(fname,dname);
     
-                               if(!mask_match(fname, mask, case_sensitive))
+                               if(!mask_match(fname, mask, conn->case_sensitive))
                                        continue;
 
                                error = ERRnoaccess;
@@ -4218,7 +4417,7 @@ int reply_setdir(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
                return ERROR_DOS(ERRDOS,ERRnoaccess);
        }
 
-       srvstr_get_path(inbuf, newdir, smb_buf(inbuf) + 1, sizeof(newdir), 0, STR_TERMINATE, &status);
+       srvstr_get_path(inbuf, newdir, smb_buf(inbuf) + 1, sizeof(newdir), 0, STR_TERMINATE, &status, False);
        if (!NT_STATUS_IS_OK(status)) {
                END_PROFILE(pathworks_setdir);
                return ERROR_NT(status);
@@ -4406,11 +4605,16 @@ int reply_lockingX(connection_struct *conn, char *inbuf,char *outbuf,int length,
        
        data = smb_buf(inbuf);
 
-       if (locktype & (LOCKING_ANDX_CANCEL_LOCK | LOCKING_ANDX_CHANGE_LOCKTYPE)) {
+       if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
                /* we don't support these - and CANCEL_LOCK makes w2k
                   and XP reboot so I don't really want to be
                   compatible! (tridge) */
-               return ERROR_NT(NT_STATUS_NOT_SUPPORTED);
+               return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
+       }
+       
+       if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
+               /* Need to make this like a cancel.... JRA. */
+               return ERROR_NT(NT_STATUS_UNSUCCESSFUL);
        }
        
        /* Check if this is an oplock break on a file
@@ -4620,7 +4824,7 @@ int reply_readbmpx(connection_struct *conn, char *inbuf,char *outbuf,int length,
        tcount = maxcount;
        total_read = 0;
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)maxcount,(SMB_BIG_UINT)startpos, READ_LOCK)) {
                END_PROFILE(SMBreadBmpx);
                return ERROR_DOS(ERRDOS,ERRlock);
        }
@@ -4746,7 +4950,7 @@ int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size,
                not an SMBwritebmpx - set this up now so we don't forget */
        SCVAL(outbuf,smb_com,SMBwritec);
 
-       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos,WRITE_LOCK,False)) {
+       if (is_locked(fsp,conn,(SMB_BIG_UINT)tcount,(SMB_BIG_UINT)startpos,WRITE_LOCK)) {
                END_PROFILE(SMBwriteBmpx);
                return(ERROR_DOS(ERRDOS,ERRlock));
        }
@@ -4771,7 +4975,7 @@ int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int size,
                if(fsp->wbmpx_ptr != NULL)
                        wbms = fsp->wbmpx_ptr; /* Use an existing struct */
                else
-                       wbms = (write_bmpx_struct *)malloc(sizeof(write_bmpx_struct));
+                       wbms = SMB_MALLOC_P(write_bmpx_struct);
                if(!wbms) {
                        DEBUG(0,("Out of memory in reply_readmpx\n"));
                        END_PROFILE(SMBwriteBmpx);