source/libsmb/clitrans.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client transaction calls
   4    Copyright (C) Andrew Tridgell 1994-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 */
  20
  21 #define NO_SYSLOG
  22
  23 #include "includes.h"
  24
  25
  26 /****************************************************************************
  27  Send a SMB trans or trans2 request.
  28 ****************************************************************************/
  29
  30 BOOL cli_send_trans(struct cli_state *cli, int trans,
  31                     const char *pipe_name,
  32                     int fid, int flags,
  33                     uint16 *setup, unsigned int lsetup, unsigned int msetup,
  34                     const char *param, unsigned int lparam, unsigned int mparam,
  35                     const char *data, unsigned int ldata, unsigned int mdata)
  36 {
  37         unsigned int i;
  38         unsigned int this_ldata,this_lparam;
  39         unsigned int tot_data=0,tot_param=0;
  40         char *outdata,*outparam;
  41         char *p;
  42         int pipe_name_len=0;
  43         uint16 mid;
  44
  45         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
  46         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
  47
  48         memset(cli->outbuf,'\0',smb_size);
  49         set_message(cli->outbuf,14+lsetup,0,True);
  50         SCVAL(cli->outbuf,smb_com,trans);
  51         SSVAL(cli->outbuf,smb_tid, cli->cnum);
  52         cli_setup_packet(cli);
  53         mid = cli->mid;
  54
  55         if (pipe_name) {
  56                 pipe_name_len = clistr_push(cli, smb_buf(cli->outbuf), pipe_name, -1, STR_TERMINATE);
  57         }
  58
  59         outparam = smb_buf(cli->outbuf)+(trans==SMBtrans ? pipe_name_len : 3);
  60         outdata = outparam+this_lparam;
  61
  62         /* primary request */
  63         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
  64         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
  65         SSVAL(cli->outbuf,smb_mprcnt,mparam);   /* mprcnt */
  66         SSVAL(cli->outbuf,smb_mdrcnt,mdata);    /* mdrcnt */
  67         SCVAL(cli->outbuf,smb_msrcnt,msetup);   /* msrcnt */
  68         SSVAL(cli->outbuf,smb_flags,flags);     /* flags */
  69         SIVAL(cli->outbuf,smb_timeout,0);               /* timeout */
  70         SSVAL(cli->outbuf,smb_pscnt,this_lparam);       /* pscnt */
  71         SSVAL(cli->outbuf,smb_psoff,smb_offset(outparam,cli->outbuf)); /* psoff */
  72         SSVAL(cli->outbuf,smb_dscnt,this_ldata);        /* dscnt */
  73         SSVAL(cli->outbuf,smb_dsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
  74         SCVAL(cli->outbuf,smb_suwcnt,lsetup);   /* suwcnt */
  75         for (i=0;i<lsetup;i++)          /* setup[] */
  76                 SSVAL(cli->outbuf,smb_setup+i*2,setup[i]);
  77         p = smb_buf(cli->outbuf);
  78         if (trans != SMBtrans) {
  79                 *p++ = 0;  /* put in a null smb_name */
  80                 *p++ = 'D'; *p++ = ' '; /* observed in OS/2 */
  81         }
  82         if (this_lparam)                        /* param[] */
  83                 memcpy(outparam,param,this_lparam);
  84         if (this_ldata)                 /* data[] */
  85                 memcpy(outdata,data,this_ldata);
  86         cli_setup_bcc(cli, outdata+this_ldata);
  87
  88         show_msg(cli->outbuf);
  89
  90         cli_signing_trans_start(cli);
  91         if (!cli_send_smb(cli)) {
  92                 cli_signing_trans_stop(cli);
  93                 return False;
  94         }
  95
  96         if (this_ldata < ldata || this_lparam < lparam) {
  97                 /* receive interim response */
  98                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
  99                         cli_signing_trans_stop(cli);
 100                         return(False);
 101                 }
 102
 103                 tot_data = this_ldata;
 104                 tot_param = this_lparam;
 105
 106                 while (tot_data < ldata || tot_param < lparam)  {
 107                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 108                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 109
 110                         set_message(cli->outbuf,trans==SMBtrans?8:9,0,True);
 111                         SCVAL(cli->outbuf,smb_com,(trans==SMBtrans ? SMBtranss : SMBtranss2));
 112
 113                         outparam = smb_buf(cli->outbuf);
 114                         outdata = outparam+this_lparam;
 115
 116                         /* secondary request */
 117                         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
 118                         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
 119                         SSVAL(cli->outbuf,smb_spscnt,this_lparam);      /* pscnt */
 120                         SSVAL(cli->outbuf,smb_spsoff,smb_offset(outparam,cli->outbuf)); /* psoff */
 121                         SSVAL(cli->outbuf,smb_spsdisp,tot_param);       /* psdisp */
 122                         SSVAL(cli->outbuf,smb_sdscnt,this_ldata);       /* dscnt */
 123                         SSVAL(cli->outbuf,smb_sdsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
 124                         SSVAL(cli->outbuf,smb_sdsdisp,tot_data);        /* dsdisp */
 125                         if (trans==SMBtrans2)
 126                                 SSVALS(cli->outbuf,smb_sfid,fid);               /* fid */
 127                         if (this_lparam)                        /* param[] */
 128                                 memcpy(outparam,param+tot_param,this_lparam);
 129                         if (this_ldata)                 /* data[] */
 130                                 memcpy(outdata,data+tot_data,this_ldata);
 131                         cli_setup_bcc(cli, outdata+this_ldata);
 132
 133                         /* Ensure this packet has the same MID as
 134                          * the primary. Important in signing. JRA. */
 135                         cli->mid = mid;
 136
 137                         show_msg(cli->outbuf);
 138                         if (!cli_send_smb(cli)) {
 139                                 cli_signing_trans_stop(cli);
 140                                 return False;
 141                         }
 142
 143                         tot_data += this_ldata;
 144                         tot_param += this_lparam;
 145                 }
 146         }
 147
 148         return(True);
 149 }
 150
 151 /****************************************************************************
 152  Receive a SMB trans or trans2 response allocating the necessary memory.
 153 ****************************************************************************/
 154
 155 BOOL cli_receive_trans(struct cli_state *cli,int trans,
 156                               char **param, unsigned int *param_len,
 157                               char **data, unsigned int *data_len)
 158 {
 159         unsigned int total_data=0;
 160         unsigned int total_param=0;
 161         unsigned int this_data,this_param;
 162         NTSTATUS status;
 163         char *tdata;
 164         char *tparam;
 165
 166         *data_len = *param_len = 0;
 167
 168         if (!cli_receive_smb(cli)) {
 169                 cli_signing_trans_stop(cli);
 170                 return False;
 171         }
 172
 173         show_msg(cli->inbuf);
 174
 175         /* sanity check */
 176         if (CVAL(cli->inbuf,smb_com) != trans) {
 177                 DEBUG(0,("Expected %s response, got command 0x%02x\n",
 178                          trans==SMBtrans?"SMBtrans":"SMBtrans2",
 179                          CVAL(cli->inbuf,smb_com)));
 180                 cli_signing_trans_stop(cli);
 181                 return(False);
 182         }
 183
 184         /*
 185          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 186          * to a trans call. This is not an error and should not
 187          * be treated as such.
 188          */
 189         status = cli_nt_error(cli);
 190
 191         if (NT_STATUS_IS_ERR(status)) {
 192                 cli_signing_trans_stop(cli);
 193                 return False;
 194         }
 195
 196         /* parse out the lengths */
 197         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 198         total_param = SVAL(cli->inbuf,smb_tprcnt);
 199
 200         /* allocate it */
 201         if (total_data!=0) {
 202                 tdata = Realloc(*data,total_data);
 203                 if (!tdata) {
 204                         DEBUG(0,("cli_receive_trans: failed to enlarge data buffer\n"));
 205                         cli_signing_trans_stop(cli);
 206                         return False;
 207                 }
 208                 else
 209                         *data = tdata;
 210         }
 211
 212         if (total_param!=0) {
 213                 tparam = Realloc(*param,total_param);
 214                 if (!tparam) {
 215                         DEBUG(0,("cli_receive_trans: failed to enlarge param buffer\n"));
 216                         cli_signing_trans_stop(cli);
 217                         return False;
 218                 }
 219                 else
 220                         *param = tparam;
 221         }
 222
 223         for (;;)  {
 224                 this_data = SVAL(cli->inbuf,smb_drcnt);
 225                 this_param = SVAL(cli->inbuf,smb_prcnt);
 226
 227                 if (this_data + *data_len > total_data ||
 228                     this_param + *param_len > total_param) {
 229                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 230                         cli_signing_trans_stop(cli);
 231                         return False;
 232                 }
 233
 234                 if (this_data + *data_len < this_data ||
 235                                 this_data + *data_len < *data_len ||
 236                                 this_param + *param_len < this_param ||
 237                                 this_param + *param_len < *param_len) {
 238                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 239                         cli_signing_trans_stop(cli);
 240                         return False;
 241                 }
 242
 243                 if (this_data) {
 244                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_drdisp);
 245                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_droff);
 246
 247                         if (data_offset_out > total_data ||
 248                                         data_offset_out + this_data > total_data ||
 249                                         data_offset_out + this_data < data_offset_out ||
 250                                         data_offset_out + this_data < this_data) {
 251                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 252                                 cli_signing_trans_stop(cli);
 253                                 return False;
 254                         }
 255                         if (data_offset_in > cli->bufsize ||
 256                                         data_offset_in + this_data >  cli->bufsize ||
 257                                         data_offset_in + this_data < data_offset_in ||
 258                                         data_offset_in + this_data < this_data) {
 259                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 260                                 cli_signing_trans_stop(cli);
 261                                 return False;
 262                         }
 263
 264                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 265                 }
 266                 if (this_param) {
 267                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_prdisp);
 268                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_proff);
 269
 270                         if (param_offset_out > total_param ||
 271                                         param_offset_out + this_param > total_param ||
 272                                         param_offset_out + this_param < param_offset_out ||
 273                                         param_offset_out + this_param < this_param) {
 274                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 275                                 cli_signing_trans_stop(cli);
 276                                 return False;
 277                         }
 278                         if (param_offset_in > cli->bufsize ||
 279                                         param_offset_in + this_param >  cli->bufsize ||
 280                                         param_offset_in + this_param < param_offset_in ||
 281                                         param_offset_in + this_param < this_param) {
 282                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 283                                 cli_signing_trans_stop(cli);
 284                                 return False;
 285                         }
 286
 287                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 288                 }
 289                 *data_len += this_data;
 290                 *param_len += this_param;
 291
 292                 if (total_data <= *data_len && total_param <= *param_len)
 293                         break;
 294
 295                 if (!cli_receive_smb(cli)) {
 296                         cli_signing_trans_stop(cli);
 297                         return False;
 298                 }
 299
 300                 show_msg(cli->inbuf);
 301
 302                 /* sanity check */
 303                 if (CVAL(cli->inbuf,smb_com) != trans) {
 304                         DEBUG(0,("Expected %s response, got command 0x%02x\n",
 305                                  trans==SMBtrans?"SMBtrans":"SMBtrans2",
 306                                  CVAL(cli->inbuf,smb_com)));
 307                         cli_signing_trans_stop(cli);
 308                         return(False);
 309                 }
 310                 if (NT_STATUS_IS_ERR(cli_nt_error(cli))) {
 311                         cli_signing_trans_stop(cli);
 312                         return(False);
 313                 }
 314
 315                 /* parse out the total lengths again - they can shrink! */
 316                 if (SVAL(cli->inbuf,smb_tdrcnt) < total_data)
 317                         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 318                 if (SVAL(cli->inbuf,smb_tprcnt) < total_param)
 319                         total_param = SVAL(cli->inbuf,smb_tprcnt);
 320
 321                 if (total_data <= *data_len && total_param <= *param_len)
 322                         break;
 323
 324         }
 325
 326         cli_signing_trans_stop(cli);
 327         return(True);
 328 }
 329
 330 /****************************************************************************
 331  Send a SMB nttrans request.
 332 ****************************************************************************/
 333
 334 BOOL cli_send_nt_trans(struct cli_state *cli,
 335                        int function,
 336                        int flags,
 337                        uint16 *setup, unsigned int lsetup, unsigned int msetup,
 338                        char *param, unsigned int lparam, unsigned int mparam,
 339                        char *data, unsigned int ldata, unsigned int mdata)
 340 {
 341         unsigned int i;
 342         unsigned int this_ldata,this_lparam;
 343         unsigned int tot_data=0,tot_param=0;
 344         uint16 mid;
 345         char *outdata,*outparam;
 346
 347         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
 348         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
 349
 350         memset(cli->outbuf,'\0',smb_size);
 351         set_message(cli->outbuf,19+lsetup,0,True);
 352         SCVAL(cli->outbuf,smb_com,SMBnttrans);
 353         SSVAL(cli->outbuf,smb_tid, cli->cnum);
 354         cli_setup_packet(cli);
 355         mid = cli->mid;
 356
 357         outparam = smb_buf(cli->outbuf)+3;
 358         outdata = outparam+this_lparam;
 359
 360         /* primary request */
 361         SCVAL(cli->outbuf,smb_nt_MaxSetupCount,msetup);
 362         SCVAL(cli->outbuf,smb_nt_Flags,flags);
 363         SIVAL(cli->outbuf,smb_nt_TotalParameterCount, lparam);
 364         SIVAL(cli->outbuf,smb_nt_TotalDataCount, ldata);
 365         SIVAL(cli->outbuf,smb_nt_MaxParameterCount, mparam);
 366         SIVAL(cli->outbuf,smb_nt_MaxDataCount, mdata);
 367         SIVAL(cli->outbuf,smb_nt_ParameterCount, this_lparam);
 368         SIVAL(cli->outbuf,smb_nt_ParameterOffset, smb_offset(outparam,cli->outbuf));
 369         SIVAL(cli->outbuf,smb_nt_DataCount, this_ldata);
 370         SIVAL(cli->outbuf,smb_nt_DataOffset, smb_offset(outdata,cli->outbuf));
 371         SIVAL(cli->outbuf,smb_nt_SetupCount, lsetup);
 372         SIVAL(cli->outbuf,smb_nt_Function, function);
 373         for (i=0;i<lsetup;i++)          /* setup[] */
 374                 SSVAL(cli->outbuf,smb_nt_SetupStart+i*2,setup[i]);
 375
 376         if (this_lparam)                        /* param[] */
 377                 memcpy(outparam,param,this_lparam);
 378         if (this_ldata)                 /* data[] */
 379                 memcpy(outdata,data,this_ldata);
 380
 381         cli_setup_bcc(cli, outdata+this_ldata);
 382
 383         show_msg(cli->outbuf);
 384         cli_signing_trans_start(cli);
 385         if (!cli_send_smb(cli)) {
 386                 cli_signing_trans_stop(cli);
 387                 return False;
 388         }
 389
 390         if (this_ldata < ldata || this_lparam < lparam) {
 391                 /* receive interim response */
 392                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
 393                         cli_signing_trans_stop(cli);
 394                         return(False);
 395                 }
 396
 397                 tot_data = this_ldata;
 398                 tot_param = this_lparam;
 399
 400                 while (tot_data < ldata || tot_param < lparam)  {
 401                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 402                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 403
 404                         set_message(cli->outbuf,18,0,True);
 405                         SCVAL(cli->outbuf,smb_com,SMBnttranss);
 406
 407                         /* XXX - these should probably be aligned */
 408                         outparam = smb_buf(cli->outbuf);
 409                         outdata = outparam+this_lparam;
 410
 411                         /* secondary request */
 412                         SIVAL(cli->outbuf,smb_nts_TotalParameterCount,lparam);
 413                         SIVAL(cli->outbuf,smb_nts_TotalDataCount,ldata);
 414                         SIVAL(cli->outbuf,smb_nts_ParameterCount,this_lparam);
 415                         SIVAL(cli->outbuf,smb_nts_ParameterOffset,smb_offset(outparam,cli->outbuf));
 416                         SIVAL(cli->outbuf,smb_nts_ParameterDisplacement,tot_param);
 417                         SIVAL(cli->outbuf,smb_nts_DataCount,this_ldata);
 418                         SIVAL(cli->outbuf,smb_nts_DataOffset,smb_offset(outdata,cli->outbuf));
 419                         SIVAL(cli->outbuf,smb_nts_DataDisplacement,tot_data);
 420                         if (this_lparam)                        /* param[] */
 421                                 memcpy(outparam,param+tot_param,this_lparam);
 422                         if (this_ldata)                 /* data[] */
 423                                 memcpy(outdata,data+tot_data,this_ldata);
 424                         cli_setup_bcc(cli, outdata+this_ldata);
 425
 426                         /* Ensure this packet has the same MID as
 427                          * the primary. Important in signing. JRA. */
 428                         cli->mid = mid;
 429
 430                         show_msg(cli->outbuf);
 431
 432                         if (!cli_send_smb(cli)) {
 433                                 cli_signing_trans_stop(cli);
 434                                 return False;
 435                         }
 436
 437                         tot_data += this_ldata;
 438                         tot_param += this_lparam;
 439                 }
 440         }
 441
 442         return(True);
 443 }
 444
 445 /****************************************************************************
 446   receive a SMB nttrans response allocating the necessary memory
 447   ****************************************************************************/
 448
 449 BOOL cli_receive_nt_trans(struct cli_state *cli,
 450                           char **param, unsigned int *param_len,
 451                           char **data, unsigned int *data_len)
 452 {
 453         unsigned int total_data=0;
 454         unsigned int total_param=0;
 455         unsigned int this_data,this_param;
 456         uint8 eclass;
 457         uint32 ecode;
 458         char *tdata;
 459         char *tparam;
 460
 461         *data_len = *param_len = 0;
 462
 463         if (!cli_receive_smb(cli)) {
 464                 cli_signing_trans_stop(cli);
 465                 return False;
 466         }
 467
 468         show_msg(cli->inbuf);
 469
 470         /* sanity check */
 471         if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 472                 DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 473                          CVAL(cli->inbuf,smb_com)));
 474                 cli_signing_trans_stop(cli);
 475                 return(False);
 476         }
 477
 478         /*
 479          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 480          * to a trans call. This is not an error and should not
 481          * be treated as such.
 482          */
 483         if (cli_is_dos_error(cli)) {
 484                 cli_dos_error(cli, &eclass, &ecode);
 485                 if (cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata)) {
 486                         cli_signing_trans_stop(cli);
 487                         return(False);
 488                 }
 489         }
 490
 491         /* parse out the lengths */
 492         total_data = SVAL(cli->inbuf,smb_ntr_TotalDataCount);
 493         total_param = SVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 494
 495         /* allocate it */
 496         if (total_data) {
 497                 tdata = Realloc(*data,total_data);
 498                 if (!tdata) {
 499                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge data buffer to %d\n",total_data));
 500                         cli_signing_trans_stop(cli);
 501                         return False;
 502                 } else {
 503                         *data = tdata;
 504                 }
 505         }
 506
 507         if (total_param) {
 508                 tparam = Realloc(*param,total_param);
 509                 if (!tparam) {
 510                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge param buffer to %d\n", total_param));
 511                         cli_signing_trans_stop(cli);
 512                         return False;
 513                 } else {
 514                         *param = tparam;
 515                 }
 516         }
 517
 518         while (1)  {
 519                 this_data = SVAL(cli->inbuf,smb_ntr_DataCount);
 520                 this_param = SVAL(cli->inbuf,smb_ntr_ParameterCount);
 521
 522                 if (this_data + *data_len > total_data ||
 523                     this_param + *param_len > total_param) {
 524                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 525                         cli_signing_trans_stop(cli);
 526                         return False;
 527                 }
 528
 529                 if (this_data + *data_len < this_data ||
 530                                 this_data + *data_len < *data_len ||
 531                                 this_param + *param_len < this_param ||
 532                                 this_param + *param_len < *param_len) {
 533                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 534                         cli_signing_trans_stop(cli);
 535                         return False;
 536                 }
 537
 538                 if (this_data) {
 539                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_ntr_DataDisplacement);
 540                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_ntr_DataOffset);
 541
 542                         if (data_offset_out > total_data ||
 543                                         data_offset_out + this_data > total_data ||
 544                                         data_offset_out + this_data < data_offset_out ||
 545                                         data_offset_out + this_data < this_data) {
 546                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 547                                 cli_signing_trans_stop(cli);
 548                                 return False;
 549                         }
 550                         if (data_offset_in > cli->bufsize ||
 551                                         data_offset_in + this_data >  cli->bufsize ||
 552                                         data_offset_in + this_data < data_offset_in ||
 553                                         data_offset_in + this_data < this_data) {
 554                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 555                                 cli_signing_trans_stop(cli);
 556                                 return False;
 557                         }
 558
 559                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 560                 }
 561
 562                 if (this_param) {
 563                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_ntr_ParameterDisplacement);
 564                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_ntr_ParameterOffset);
 565
 566                         if (param_offset_out > total_param ||
 567                                         param_offset_out + this_param > total_param ||
 568                                         param_offset_out + this_param < param_offset_out ||
 569                                         param_offset_out + this_param < this_param) {
 570                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 571                                 cli_signing_trans_stop(cli);
 572                                 return False;
 573                         }
 574                         if (param_offset_in > cli->bufsize ||
 575                                         param_offset_in + this_param >  cli->bufsize ||
 576                                         param_offset_in + this_param < param_offset_in ||
 577                                         param_offset_in + this_param < this_param) {
 578                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 579                                 cli_signing_trans_stop(cli);
 580                                 return False;
 581                         }
 582
 583                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 584                 }
 585
 586                 *data_len += this_data;
 587                 *param_len += this_param;
 588
 589                 if (total_data <= *data_len && total_param <= *param_len)
 590                         break;
 591
 592                 if (!cli_receive_smb(cli)) {
 593                         cli_signing_trans_stop(cli);
 594                         return False;
 595                 }
 596
 597                 show_msg(cli->inbuf);
 598
 599                 /* sanity check */
 600                 if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 601                         DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 602                                  CVAL(cli->inbuf,smb_com)));
 603                         cli_signing_trans_stop(cli);
 604                         return(False);
 605                 }
 606                 if (cli_is_dos_error(cli)) {
 607                         cli_dos_error(cli, &eclass, &ecode);
 608                         if(cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata)) {
 609                                 cli_signing_trans_stop(cli);
 610                                 return(False);
 611                         }
 612                 }
 613                 /* parse out the total lengths again - they can shrink! */
 614                 if (SVAL(cli->inbuf,smb_ntr_TotalDataCount) < total_data)
 615                         total_data = SVAL(cli->inbuf,smb_ntr_TotalDataCount);
 616                 if (SVAL(cli->inbuf,smb_ntr_TotalParameterCount) < total_param)
 617                         total_param = SVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 618
 619                 if (total_data <= *data_len && total_param <= *param_len)
 620                         break;
 621         }
 622
 623         cli_signing_trans_stop(cli);
 624         return(True);
 625 }