source3/libsmb/clitrans.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client transaction calls
   4    Copyright (C) Andrew Tridgell 1994-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 */
  20
  21 #define NO_SYSLOG
  22
  23 #include "includes.h"
  24
  25
  26 /****************************************************************************
  27  Send a SMB trans or trans2 request.
  28 ****************************************************************************/
  29
  30 BOOL cli_send_trans(struct cli_state *cli, int trans,
  31                     const char *pipe_name,
  32                     int fid, int flags,
  33                     uint16 *setup, unsigned int lsetup, unsigned int msetup,
  34                     const char *param, unsigned int lparam, unsigned int mparam,
  35                     const char *data, unsigned int ldata, unsigned int mdata)
  36 {
  37         unsigned int i;
  38         unsigned int this_ldata,this_lparam;
  39         unsigned int tot_data=0,tot_param=0;
  40         char *outdata,*outparam;
  41         char *p;
  42         int pipe_name_len=0;
  43         uint16 mid;
  44
  45         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
  46         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
  47
  48         memset(cli->outbuf,'\0',smb_size);
  49         set_message(cli->outbuf,14+lsetup,0,True);
  50         SCVAL(cli->outbuf,smb_com,trans);
  51         SSVAL(cli->outbuf,smb_tid, cli->cnum);
  52         cli_setup_packet(cli);
  53         mid = cli->mid;
  54
  55         if (pipe_name) {
  56                 pipe_name_len = clistr_push(cli, smb_buf(cli->outbuf), pipe_name, -1, STR_TERMINATE);
  57         }
  58
  59         outparam = smb_buf(cli->outbuf)+(trans==SMBtrans ? pipe_name_len : 3);
  60         outdata = outparam+this_lparam;
  61
  62         /* primary request */
  63         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
  64         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
  65         SSVAL(cli->outbuf,smb_mprcnt,mparam);   /* mprcnt */
  66         SSVAL(cli->outbuf,smb_mdrcnt,mdata);    /* mdrcnt */
  67         SCVAL(cli->outbuf,smb_msrcnt,msetup);   /* msrcnt */
  68         SSVAL(cli->outbuf,smb_flags,flags);     /* flags */
  69         SIVAL(cli->outbuf,smb_timeout,0);               /* timeout */
  70         SSVAL(cli->outbuf,smb_pscnt,this_lparam);       /* pscnt */
  71         SSVAL(cli->outbuf,smb_psoff,smb_offset(outparam,cli->outbuf)); /* psoff */
  72         SSVAL(cli->outbuf,smb_dscnt,this_ldata);        /* dscnt */
  73         SSVAL(cli->outbuf,smb_dsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
  74         SCVAL(cli->outbuf,smb_suwcnt,lsetup);   /* suwcnt */
  75         for (i=0;i<lsetup;i++)          /* setup[] */
  76                 SSVAL(cli->outbuf,smb_setup+i*2,setup[i]);
  77         p = smb_buf(cli->outbuf);
  78         if (trans != SMBtrans) {
  79                 *p++ = 0;  /* put in a null smb_name */
  80                 *p++ = 'D'; *p++ = ' '; /* observed in OS/2 */
  81         }
  82         if (this_lparam)                        /* param[] */
  83                 memcpy(outparam,param,this_lparam);
  84         if (this_ldata)                 /* data[] */
  85                 memcpy(outdata,data,this_ldata);
  86         cli_setup_bcc(cli, outdata+this_ldata);
  87
  88         show_msg(cli->outbuf);
  89
  90         cli_signing_trans_start(cli);
  91         if (!cli_send_smb(cli)) {
  92                 cli_signing_trans_stop(cli);
  93                 return False;
  94         }
  95
  96         if (this_ldata < ldata || this_lparam < lparam) {
  97                 /* receive interim response */
  98                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
  99                         cli_signing_trans_stop(cli);
 100                         return(False);
 101                 }
 102
 103                 tot_data = this_ldata;
 104                 tot_param = this_lparam;
 105
 106                 while (tot_data < ldata || tot_param < lparam)  {
 107                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 108                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 109
 110                         set_message(cli->outbuf,trans==SMBtrans?8:9,0,True);
 111                         SCVAL(cli->outbuf,smb_com,(trans==SMBtrans ? SMBtranss : SMBtranss2));
 112
 113                         outparam = smb_buf(cli->outbuf);
 114                         outdata = outparam+this_lparam;
 115
 116                         /* secondary request */
 117                         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
 118                         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
 119                         SSVAL(cli->outbuf,smb_spscnt,this_lparam);      /* pscnt */
 120                         SSVAL(cli->outbuf,smb_spsoff,smb_offset(outparam,cli->outbuf)); /* psoff */
 121                         SSVAL(cli->outbuf,smb_spsdisp,tot_param);       /* psdisp */
 122                         SSVAL(cli->outbuf,smb_sdscnt,this_ldata);       /* dscnt */
 123                         SSVAL(cli->outbuf,smb_sdsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
 124                         SSVAL(cli->outbuf,smb_sdsdisp,tot_data);        /* dsdisp */
 125                         if (trans==SMBtrans2)
 126                                 SSVALS(cli->outbuf,smb_sfid,fid);               /* fid */
 127                         if (this_lparam)                        /* param[] */
 128                                 memcpy(outparam,param+tot_param,this_lparam);
 129                         if (this_ldata)                 /* data[] */
 130                                 memcpy(outdata,data+tot_data,this_ldata);
 131                         cli_setup_bcc(cli, outdata+this_ldata);
 132
 133                         /* Ensure this packet has the same MID as
 134                          * the primary. Important in signing. JRA. */
 135                         cli->mid = mid;
 136
 137                         /*
 138                          * Turns out that we need to increment the
 139                          * sequence number for each packet until the
 140                          * last one in the signing sequence. That's
 141                          * the one that matters to check signing replies. JRA.
 142                          */
 143
 144                         cli_signing_trans_stop(cli);
 145                         cli_signing_trans_start(cli);
 146
 147                         show_msg(cli->outbuf);
 148                         if (!cli_send_smb(cli)) {
 149                                 cli_signing_trans_stop(cli);
 150                                 return False;
 151                         }
 152
 153                         tot_data += this_ldata;
 154                         tot_param += this_lparam;
 155                 }
 156         }
 157
 158         return(True);
 159 }
 160
 161 /****************************************************************************
 162  Receive a SMB trans or trans2 response allocating the necessary memory.
 163 ****************************************************************************/
 164
 165 BOOL cli_receive_trans(struct cli_state *cli,int trans,
 166                               char **param, unsigned int *param_len,
 167                               char **data, unsigned int *data_len)
 168 {
 169         unsigned int total_data=0;
 170         unsigned int total_param=0;
 171         unsigned int this_data,this_param;
 172         NTSTATUS status;
 173         char *tdata;
 174         char *tparam;
 175
 176         *data_len = *param_len = 0;
 177
 178         if (!cli_receive_smb(cli)) {
 179                 cli_signing_trans_stop(cli);
 180                 return False;
 181         }
 182
 183         show_msg(cli->inbuf);
 184
 185         /* sanity check */
 186         if (CVAL(cli->inbuf,smb_com) != trans) {
 187                 DEBUG(0,("Expected %s response, got command 0x%02x\n",
 188                          trans==SMBtrans?"SMBtrans":"SMBtrans2",
 189                          CVAL(cli->inbuf,smb_com)));
 190                 cli_signing_trans_stop(cli);
 191                 return(False);
 192         }
 193
 194         /*
 195          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 196          * to a trans call. This is not an error and should not
 197          * be treated as such.
 198          */
 199         status = cli_nt_error(cli);
 200
 201         if (NT_STATUS_IS_ERR(status)) {
 202                 cli_signing_trans_stop(cli);
 203                 return False;
 204         }
 205
 206         /* parse out the lengths */
 207         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 208         total_param = SVAL(cli->inbuf,smb_tprcnt);
 209
 210         /* allocate it */
 211         if (total_data!=0) {
 212                 tdata = Realloc(*data,total_data);
 213                 if (!tdata) {
 214                         DEBUG(0,("cli_receive_trans: failed to enlarge data buffer\n"));
 215                         cli_signing_trans_stop(cli);
 216                         return False;
 217                 }
 218                 else
 219                         *data = tdata;
 220         }
 221
 222         if (total_param!=0) {
 223                 tparam = Realloc(*param,total_param);
 224                 if (!tparam) {
 225                         DEBUG(0,("cli_receive_trans: failed to enlarge param buffer\n"));
 226                         cli_signing_trans_stop(cli);
 227                         return False;
 228                 }
 229                 else
 230                         *param = tparam;
 231         }
 232
 233         for (;;)  {
 234                 this_data = SVAL(cli->inbuf,smb_drcnt);
 235                 this_param = SVAL(cli->inbuf,smb_prcnt);
 236
 237                 if (this_data + *data_len > total_data ||
 238                     this_param + *param_len > total_param) {
 239                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 240                         cli_signing_trans_stop(cli);
 241                         return False;
 242                 }
 243
 244                 if (this_data + *data_len < this_data ||
 245                                 this_data + *data_len < *data_len ||
 246                                 this_param + *param_len < this_param ||
 247                                 this_param + *param_len < *param_len) {
 248                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 249                         cli_signing_trans_stop(cli);
 250                         return False;
 251                 }
 252
 253                 if (this_data) {
 254                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_drdisp);
 255                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_droff);
 256
 257                         if (data_offset_out > total_data ||
 258                                         data_offset_out + this_data > total_data ||
 259                                         data_offset_out + this_data < data_offset_out ||
 260                                         data_offset_out + this_data < this_data) {
 261                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 262                                 cli_signing_trans_stop(cli);
 263                                 return False;
 264                         }
 265                         if (data_offset_in > cli->bufsize ||
 266                                         data_offset_in + this_data >  cli->bufsize ||
 267                                         data_offset_in + this_data < data_offset_in ||
 268                                         data_offset_in + this_data < this_data) {
 269                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 270                                 cli_signing_trans_stop(cli);
 271                                 return False;
 272                         }
 273
 274                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 275                 }
 276                 if (this_param) {
 277                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_prdisp);
 278                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_proff);
 279
 280                         if (param_offset_out > total_param ||
 281                                         param_offset_out + this_param > total_param ||
 282                                         param_offset_out + this_param < param_offset_out ||
 283                                         param_offset_out + this_param < this_param) {
 284                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 285                                 cli_signing_trans_stop(cli);
 286                                 return False;
 287                         }
 288                         if (param_offset_in > cli->bufsize ||
 289                                         param_offset_in + this_param >  cli->bufsize ||
 290                                         param_offset_in + this_param < param_offset_in ||
 291                                         param_offset_in + this_param < this_param) {
 292                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 293                                 cli_signing_trans_stop(cli);
 294                                 return False;
 295                         }
 296
 297                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 298                 }
 299                 *data_len += this_data;
 300                 *param_len += this_param;
 301
 302                 if (total_data <= *data_len && total_param <= *param_len)
 303                         break;
 304
 305                 if (!cli_receive_smb(cli)) {
 306                         cli_signing_trans_stop(cli);
 307                         return False;
 308                 }
 309
 310                 show_msg(cli->inbuf);
 311
 312                 /* sanity check */
 313                 if (CVAL(cli->inbuf,smb_com) != trans) {
 314                         DEBUG(0,("Expected %s response, got command 0x%02x\n",
 315                                  trans==SMBtrans?"SMBtrans":"SMBtrans2",
 316                                  CVAL(cli->inbuf,smb_com)));
 317                         cli_signing_trans_stop(cli);
 318                         return(False);
 319                 }
 320                 if (NT_STATUS_IS_ERR(cli_nt_error(cli))) {
 321                         cli_signing_trans_stop(cli);
 322                         return(False);
 323                 }
 324
 325                 /* parse out the total lengths again - they can shrink! */
 326                 if (SVAL(cli->inbuf,smb_tdrcnt) < total_data)
 327                         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 328                 if (SVAL(cli->inbuf,smb_tprcnt) < total_param)
 329                         total_param = SVAL(cli->inbuf,smb_tprcnt);
 330
 331                 if (total_data <= *data_len && total_param <= *param_len)
 332                         break;
 333
 334         }
 335
 336         cli_signing_trans_stop(cli);
 337         return(True);
 338 }
 339
 340 /****************************************************************************
 341  Send a SMB nttrans request.
 342 ****************************************************************************/
 343
 344 BOOL cli_send_nt_trans(struct cli_state *cli,
 345                        int function,
 346                        int flags,
 347                        uint16 *setup, unsigned int lsetup, unsigned int msetup,
 348                        char *param, unsigned int lparam, unsigned int mparam,
 349                        char *data, unsigned int ldata, unsigned int mdata)
 350 {
 351         unsigned int i;
 352         unsigned int this_ldata,this_lparam;
 353         unsigned int tot_data=0,tot_param=0;
 354         uint16 mid;
 355         char *outdata,*outparam;
 356
 357         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
 358         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
 359
 360         memset(cli->outbuf,'\0',smb_size);
 361         set_message(cli->outbuf,19+lsetup,0,True);
 362         SCVAL(cli->outbuf,smb_com,SMBnttrans);
 363         SSVAL(cli->outbuf,smb_tid, cli->cnum);
 364         cli_setup_packet(cli);
 365         mid = cli->mid;
 366
 367         outparam = smb_buf(cli->outbuf)+3;
 368         outdata = outparam+this_lparam;
 369
 370         /* primary request */
 371         SCVAL(cli->outbuf,smb_nt_MaxSetupCount,msetup);
 372         SCVAL(cli->outbuf,smb_nt_Flags,flags);
 373         SIVAL(cli->outbuf,smb_nt_TotalParameterCount, lparam);
 374         SIVAL(cli->outbuf,smb_nt_TotalDataCount, ldata);
 375         SIVAL(cli->outbuf,smb_nt_MaxParameterCount, mparam);
 376         SIVAL(cli->outbuf,smb_nt_MaxDataCount, mdata);
 377         SIVAL(cli->outbuf,smb_nt_ParameterCount, this_lparam);
 378         SIVAL(cli->outbuf,smb_nt_ParameterOffset, smb_offset(outparam,cli->outbuf));
 379         SIVAL(cli->outbuf,smb_nt_DataCount, this_ldata);
 380         SIVAL(cli->outbuf,smb_nt_DataOffset, smb_offset(outdata,cli->outbuf));
 381         SIVAL(cli->outbuf,smb_nt_SetupCount, lsetup);
 382         SIVAL(cli->outbuf,smb_nt_Function, function);
 383         for (i=0;i<lsetup;i++)          /* setup[] */
 384                 SSVAL(cli->outbuf,smb_nt_SetupStart+i*2,setup[i]);
 385
 386         if (this_lparam)                        /* param[] */
 387                 memcpy(outparam,param,this_lparam);
 388         if (this_ldata)                 /* data[] */
 389                 memcpy(outdata,data,this_ldata);
 390
 391         cli_setup_bcc(cli, outdata+this_ldata);
 392
 393         show_msg(cli->outbuf);
 394         cli_signing_trans_start(cli);
 395         if (!cli_send_smb(cli)) {
 396                 cli_signing_trans_stop(cli);
 397                 return False;
 398         }
 399
 400         if (this_ldata < ldata || this_lparam < lparam) {
 401                 /* receive interim response */
 402                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
 403                         cli_signing_trans_stop(cli);
 404                         return(False);
 405                 }
 406
 407                 tot_data = this_ldata;
 408                 tot_param = this_lparam;
 409
 410                 while (tot_data < ldata || tot_param < lparam)  {
 411                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 412                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 413
 414                         set_message(cli->outbuf,18,0,True);
 415                         SCVAL(cli->outbuf,smb_com,SMBnttranss);
 416
 417                         /* XXX - these should probably be aligned */
 418                         outparam = smb_buf(cli->outbuf);
 419                         outdata = outparam+this_lparam;
 420
 421                         /* secondary request */
 422                         SIVAL(cli->outbuf,smb_nts_TotalParameterCount,lparam);
 423                         SIVAL(cli->outbuf,smb_nts_TotalDataCount,ldata);
 424                         SIVAL(cli->outbuf,smb_nts_ParameterCount,this_lparam);
 425                         SIVAL(cli->outbuf,smb_nts_ParameterOffset,smb_offset(outparam,cli->outbuf));
 426                         SIVAL(cli->outbuf,smb_nts_ParameterDisplacement,tot_param);
 427                         SIVAL(cli->outbuf,smb_nts_DataCount,this_ldata);
 428                         SIVAL(cli->outbuf,smb_nts_DataOffset,smb_offset(outdata,cli->outbuf));
 429                         SIVAL(cli->outbuf,smb_nts_DataDisplacement,tot_data);
 430                         if (this_lparam)                        /* param[] */
 431                                 memcpy(outparam,param+tot_param,this_lparam);
 432                         if (this_ldata)                 /* data[] */
 433                                 memcpy(outdata,data+tot_data,this_ldata);
 434                         cli_setup_bcc(cli, outdata+this_ldata);
 435
 436                         /* Ensure this packet has the same MID as
 437                          * the primary. Important in signing. JRA. */
 438                         cli->mid = mid;
 439
 440                         /*
 441                          * Turns out that we need to increment the
 442                          * sequence number for each packet until the
 443                          * last one in the signing sequence. That's
 444                          * the one that matters to check signing replies. JRA.
 445                          */
 446
 447                         cli_signing_trans_stop(cli);
 448                         cli_signing_trans_start(cli);
 449
 450                         show_msg(cli->outbuf);
 451
 452                         if (!cli_send_smb(cli)) {
 453                                 cli_signing_trans_stop(cli);
 454                                 return False;
 455                         }
 456
 457                         tot_data += this_ldata;
 458                         tot_param += this_lparam;
 459                 }
 460         }
 461
 462         return(True);
 463 }
 464
 465 /****************************************************************************
 466   receive a SMB nttrans response allocating the necessary memory
 467   ****************************************************************************/
 468
 469 BOOL cli_receive_nt_trans(struct cli_state *cli,
 470                           char **param, unsigned int *param_len,
 471                           char **data, unsigned int *data_len)
 472 {
 473         unsigned int total_data=0;
 474         unsigned int total_param=0;
 475         unsigned int this_data,this_param;
 476         uint8 eclass;
 477         uint32 ecode;
 478         char *tdata;
 479         char *tparam;
 480
 481         *data_len = *param_len = 0;
 482
 483         if (!cli_receive_smb(cli)) {
 484                 cli_signing_trans_stop(cli);
 485                 return False;
 486         }
 487
 488         show_msg(cli->inbuf);
 489
 490         /* sanity check */
 491         if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 492                 DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 493                          CVAL(cli->inbuf,smb_com)));
 494                 cli_signing_trans_stop(cli);
 495                 return(False);
 496         }
 497
 498         /*
 499          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 500          * to a trans call. This is not an error and should not
 501          * be treated as such.
 502          */
 503         if (cli_is_dos_error(cli)) {
 504                 cli_dos_error(cli, &eclass, &ecode);
 505                 if (cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata)) {
 506                         cli_signing_trans_stop(cli);
 507                         return(False);
 508                 }
 509         }
 510
 511         /*
 512          * Likewise for NT_STATUS_BUFFER_TOO_SMALL
 513          */
 514         if (cli_is_nt_error(cli)) {
 515                 if (!NT_STATUS_EQUAL(cli_nt_error(cli),
 516                                      NT_STATUS_BUFFER_TOO_SMALL)) {
 517                         cli_signing_trans_stop(cli);
 518                         return(False);
 519                 }
 520         }
 521
 522         /* parse out the lengths */
 523         total_data = SVAL(cli->inbuf,smb_ntr_TotalDataCount);
 524         total_param = SVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 525
 526         /* allocate it */
 527         if (total_data) {
 528                 tdata = Realloc(*data,total_data);
 529                 if (!tdata) {
 530                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge data buffer to %d\n",total_data));
 531                         cli_signing_trans_stop(cli);
 532                         return False;
 533                 } else {
 534                         *data = tdata;
 535                 }
 536         }
 537
 538         if (total_param) {
 539                 tparam = Realloc(*param,total_param);
 540                 if (!tparam) {
 541                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge param buffer to %d\n", total_param));
 542                         cli_signing_trans_stop(cli);
 543                         return False;
 544                 } else {
 545                         *param = tparam;
 546                 }
 547         }
 548
 549         while (1)  {
 550                 this_data = SVAL(cli->inbuf,smb_ntr_DataCount);
 551                 this_param = SVAL(cli->inbuf,smb_ntr_ParameterCount);
 552
 553                 if (this_data + *data_len > total_data ||
 554                     this_param + *param_len > total_param) {
 555                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 556                         cli_signing_trans_stop(cli);
 557                         return False;
 558                 }
 559
 560                 if (this_data + *data_len < this_data ||
 561                                 this_data + *data_len < *data_len ||
 562                                 this_param + *param_len < this_param ||
 563                                 this_param + *param_len < *param_len) {
 564                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 565                         cli_signing_trans_stop(cli);
 566                         return False;
 567                 }
 568
 569                 if (this_data) {
 570                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_ntr_DataDisplacement);
 571                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_ntr_DataOffset);
 572
 573                         if (data_offset_out > total_data ||
 574                                         data_offset_out + this_data > total_data ||
 575                                         data_offset_out + this_data < data_offset_out ||
 576                                         data_offset_out + this_data < this_data) {
 577                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 578                                 cli_signing_trans_stop(cli);
 579                                 return False;
 580                         }
 581                         if (data_offset_in > cli->bufsize ||
 582                                         data_offset_in + this_data >  cli->bufsize ||
 583                                         data_offset_in + this_data < data_offset_in ||
 584                                         data_offset_in + this_data < this_data) {
 585                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 586                                 cli_signing_trans_stop(cli);
 587                                 return False;
 588                         }
 589
 590                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 591                 }
 592
 593                 if (this_param) {
 594                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_ntr_ParameterDisplacement);
 595                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_ntr_ParameterOffset);
 596
 597                         if (param_offset_out > total_param ||
 598                                         param_offset_out + this_param > total_param ||
 599                                         param_offset_out + this_param < param_offset_out ||
 600                                         param_offset_out + this_param < this_param) {
 601                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 602                                 cli_signing_trans_stop(cli);
 603                                 return False;
 604                         }
 605                         if (param_offset_in > cli->bufsize ||
 606                                         param_offset_in + this_param >  cli->bufsize ||
 607                                         param_offset_in + this_param < param_offset_in ||
 608                                         param_offset_in + this_param < this_param) {
 609                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 610                                 cli_signing_trans_stop(cli);
 611                                 return False;
 612                         }
 613
 614                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 615                 }
 616
 617                 *data_len += this_data;
 618                 *param_len += this_param;
 619
 620                 if (total_data <= *data_len && total_param <= *param_len)
 621                         break;
 622
 623                 if (!cli_receive_smb(cli)) {
 624                         cli_signing_trans_stop(cli);
 625                         return False;
 626                 }
 627
 628                 show_msg(cli->inbuf);
 629
 630                 /* sanity check */
 631                 if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 632                         DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 633                                  CVAL(cli->inbuf,smb_com)));
 634                         cli_signing_trans_stop(cli);
 635                         return(False);
 636                 }
 637                 if (cli_is_dos_error(cli)) {
 638                         cli_dos_error(cli, &eclass, &ecode);
 639                         if(cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata)) {
 640                                 cli_signing_trans_stop(cli);
 641                                 return(False);
 642                         }
 643                 }
 644                 /* parse out the total lengths again - they can shrink! */
 645                 if (SVAL(cli->inbuf,smb_ntr_TotalDataCount) < total_data)
 646                         total_data = SVAL(cli->inbuf,smb_ntr_TotalDataCount);
 647                 if (SVAL(cli->inbuf,smb_ntr_TotalParameterCount) < total_param)
 648                         total_param = SVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 649
 650                 if (total_data <= *data_len && total_param <= *param_len)
 651                         break;
 652         }
 653
 654         cli_signing_trans_stop(cli);
 655         return(True);
 656 }