source3/libsmb/clitrans.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client transaction calls
   4    Copyright (C) Andrew Tridgell 1994-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21
  22
  23 /****************************************************************************
  24  Send a SMB trans or trans2 request.
  25 ****************************************************************************/
  26
  27 bool cli_send_trans(struct cli_state *cli, int trans,
  28                     const char *pipe_name,
  29                     int fid, int flags,
  30                     uint16 *setup, unsigned int lsetup, unsigned int msetup,
  31                     const char *param, unsigned int lparam, unsigned int mparam,
  32                     const char *data, unsigned int ldata, unsigned int mdata)
  33 {
  34         unsigned int i;
  35         unsigned int this_ldata,this_lparam;
  36         unsigned int tot_data=0,tot_param=0;
  37         char *outdata,*outparam;
  38         char *p;
  39         int pipe_name_len=0;
  40         uint16 mid;
  41
  42         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
  43         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
  44
  45         memset(cli->outbuf,'\0',smb_size);
  46         cli_set_message(cli->outbuf,14+lsetup,0,True);
  47         SCVAL(cli->outbuf,smb_com,trans);
  48         SSVAL(cli->outbuf,smb_tid, cli->cnum);
  49         cli_setup_packet(cli);
  50
  51         /*
  52          * Save the mid we're using. We need this for finding
  53          * signing replies.
  54          */
  55
  56         mid = cli->mid;
  57
  58         if (pipe_name) {
  59                 pipe_name_len = clistr_push(cli, smb_buf(cli->outbuf), pipe_name, -1, STR_TERMINATE);
  60         }
  61
  62         outparam = smb_buf(cli->outbuf)+(trans==SMBtrans ? pipe_name_len : 3);
  63         outdata = outparam+this_lparam;
  64
  65         /* primary request */
  66         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
  67         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
  68         SSVAL(cli->outbuf,smb_mprcnt,mparam);   /* mprcnt */
  69         SSVAL(cli->outbuf,smb_mdrcnt,mdata);    /* mdrcnt */
  70         SCVAL(cli->outbuf,smb_msrcnt,msetup);   /* msrcnt */
  71         SSVAL(cli->outbuf,smb_flags,flags);     /* flags */
  72         SIVAL(cli->outbuf,smb_timeout,0);               /* timeout */
  73         SSVAL(cli->outbuf,smb_pscnt,this_lparam);       /* pscnt */
  74         SSVAL(cli->outbuf,smb_psoff,smb_offset(outparam,cli->outbuf)); /* psoff */
  75         SSVAL(cli->outbuf,smb_dscnt,this_ldata);        /* dscnt */
  76         SSVAL(cli->outbuf,smb_dsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
  77         SCVAL(cli->outbuf,smb_suwcnt,lsetup);   /* suwcnt */
  78         for (i=0;i<lsetup;i++)          /* setup[] */
  79                 SSVAL(cli->outbuf,smb_setup+i*2,setup[i]);
  80         p = smb_buf(cli->outbuf);
  81         if (trans != SMBtrans) {
  82                 *p++ = 0;  /* put in a null smb_name */
  83                 *p++ = 'D'; *p++ = ' '; /* observed in OS/2 */
  84         }
  85         if (this_lparam)                        /* param[] */
  86                 memcpy(outparam,param,this_lparam);
  87         if (this_ldata)                 /* data[] */
  88                 memcpy(outdata,data,this_ldata);
  89         cli_setup_bcc(cli, outdata+this_ldata);
  90
  91         show_msg(cli->outbuf);
  92
  93         if (!cli_send_smb(cli)) {
  94                 return False;
  95         }
  96
  97         /* Note we're in a trans state. Save the sequence
  98          * numbers for replies. */
  99         client_set_trans_sign_state_on(cli, mid);
 100
 101         if (this_ldata < ldata || this_lparam < lparam) {
 102                 /* receive interim response */
 103                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
 104                         client_set_trans_sign_state_off(cli, mid);
 105                         return(False);
 106                 }
 107
 108                 tot_data = this_ldata;
 109                 tot_param = this_lparam;
 110
 111                 while (tot_data < ldata || tot_param < lparam)  {
 112                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 113                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 114
 115                         client_set_trans_sign_state_off(cli, mid);
 116                         client_set_trans_sign_state_on(cli, mid);
 117
 118                         cli_set_message(cli->outbuf,trans==SMBtrans?8:9,0,True);
 119                         SCVAL(cli->outbuf,smb_com,(trans==SMBtrans ? SMBtranss : SMBtranss2));
 120
 121                         outparam = smb_buf(cli->outbuf);
 122                         outdata = outparam+this_lparam;
 123
 124                         /* secondary request */
 125                         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
 126                         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
 127                         SSVAL(cli->outbuf,smb_spscnt,this_lparam);      /* pscnt */
 128                         SSVAL(cli->outbuf,smb_spsoff,smb_offset(outparam,cli->outbuf)); /* psoff */
 129                         SSVAL(cli->outbuf,smb_spsdisp,tot_param);       /* psdisp */
 130                         SSVAL(cli->outbuf,smb_sdscnt,this_ldata);       /* dscnt */
 131                         SSVAL(cli->outbuf,smb_sdsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
 132                         SSVAL(cli->outbuf,smb_sdsdisp,tot_data);        /* dsdisp */
 133                         if (trans==SMBtrans2)
 134                                 SSVALS(cli->outbuf,smb_sfid,fid);               /* fid */
 135                         if (this_lparam)                        /* param[] */
 136                                 memcpy(outparam,param+tot_param,this_lparam);
 137                         if (this_ldata)                 /* data[] */
 138                                 memcpy(outdata,data+tot_data,this_ldata);
 139                         cli_setup_bcc(cli, outdata+this_ldata);
 140
 141                         /*
 142                          * Save the mid we're using. We need this for finding
 143                          * signing replies.
 144                          */
 145                         mid = cli->mid;
 146
 147                         show_msg(cli->outbuf);
 148                         if (!cli_send_smb(cli)) {
 149                                 client_set_trans_sign_state_off(cli, mid);
 150                                 return False;
 151                         }
 152
 153                         /* Ensure we use the same mid for the secondaries. */
 154                         cli->mid = mid;
 155
 156                         tot_data += this_ldata;
 157                         tot_param += this_lparam;
 158                 }
 159         }
 160
 161         return(True);
 162 }
 163
 164 /****************************************************************************
 165  Receive a SMB trans or trans2 response allocating the necessary memory.
 166 ****************************************************************************/
 167
 168 bool cli_receive_trans(struct cli_state *cli,int trans,
 169                               char **param, unsigned int *param_len,
 170                               char **data, unsigned int *data_len)
 171 {
 172         unsigned int total_data=0;
 173         unsigned int total_param=0;
 174         unsigned int this_data,this_param;
 175         NTSTATUS status;
 176         bool ret = False;
 177
 178         *data_len = *param_len = 0;
 179
 180         if (!cli_receive_smb(cli)) {
 181                 return False;
 182         }
 183
 184         show_msg(cli->inbuf);
 185
 186         /* sanity check */
 187         if (CVAL(cli->inbuf,smb_com) != trans) {
 188                 DEBUG(0,("Expected %s response, got command 0x%02x\n",
 189                          trans==SMBtrans?"SMBtrans":"SMBtrans2",
 190                          CVAL(cli->inbuf,smb_com)));
 191                 return False;
 192         }
 193
 194         /*
 195          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 196          * to a trans call. This is not an error and should not
 197          * be treated as such. Note that STATUS_NO_MORE_FILES is
 198          * returned when a trans2 findfirst/next finishes.
 199          * When setting up an encrypted transport we can also
 200          * see NT_STATUS_MORE_PROCESSING_REQUIRED here.
 201          *
 202          * Vista returns NT_STATUS_INACCESSIBLE_SYSTEM_SHORTCUT if the folder
 203          * "<share>/Users/All Users" is enumerated.  This is a special pseudo
 204          * folder, and the response does not have parameters (nor a parameter
 205          * length).
 206          */
 207         status = cli_nt_error(cli);
 208
 209         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 210                 if (NT_STATUS_IS_ERR(status) ||
 211                     NT_STATUS_EQUAL(status,STATUS_NO_MORE_FILES) ||
 212                     NT_STATUS_EQUAL(status,NT_STATUS_INACCESSIBLE_SYSTEM_SHORTCUT)) {
 213                         goto out;
 214                 }
 215         }
 216
 217         /* parse out the lengths */
 218         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 219         total_param = SVAL(cli->inbuf,smb_tprcnt);
 220
 221         /* allocate it */
 222         if (total_data!=0) {
 223                 /* We know adding 2 is safe as total_data is an
 224                  * SVAL <= 0xFFFF. */
 225                 *data = (char *)SMB_REALLOC(*data,total_data+2);
 226                 if (!(*data)) {
 227                         DEBUG(0,("cli_receive_trans: failed to enlarge data buffer\n"));
 228                         goto out;
 229                 }
 230         }
 231
 232         if (total_param!=0) {
 233                 /* We know adding 2 is safe as total_param is an
 234                  * SVAL <= 0xFFFF. */
 235                 *param = (char *)SMB_REALLOC(*param,total_param+2);
 236                 if (!(*param)) {
 237                         DEBUG(0,("cli_receive_trans: failed to enlarge param buffer\n"));
 238                         goto out;
 239                 }
 240         }
 241
 242         for (;;)  {
 243                 this_data = SVAL(cli->inbuf,smb_drcnt);
 244                 this_param = SVAL(cli->inbuf,smb_prcnt);
 245
 246                 if (this_data + *data_len > total_data ||
 247                     this_param + *param_len > total_param) {
 248                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 249                         goto out;
 250                 }
 251
 252                 if (this_data + *data_len < this_data ||
 253                                 this_data + *data_len < *data_len ||
 254                                 this_param + *param_len < this_param ||
 255                                 this_param + *param_len < *param_len) {
 256                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 257                         goto out;
 258                 }
 259
 260                 if (this_data) {
 261                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_drdisp);
 262                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_droff);
 263
 264                         if (data_offset_out > total_data ||
 265                                         data_offset_out + this_data > total_data ||
 266                                         data_offset_out + this_data < data_offset_out ||
 267                                         data_offset_out + this_data < this_data) {
 268                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 269                                 goto out;
 270                         }
 271                         if (data_offset_in > cli->bufsize ||
 272                                         data_offset_in + this_data >  cli->bufsize ||
 273                                         data_offset_in + this_data < data_offset_in ||
 274                                         data_offset_in + this_data < this_data) {
 275                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 276                                 goto out;
 277                         }
 278
 279                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 280                 }
 281                 if (this_param) {
 282                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_prdisp);
 283                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_proff);
 284
 285                         if (param_offset_out > total_param ||
 286                                         param_offset_out + this_param > total_param ||
 287                                         param_offset_out + this_param < param_offset_out ||
 288                                         param_offset_out + this_param < this_param) {
 289                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 290                                 goto out;
 291                         }
 292                         if (param_offset_in > cli->bufsize ||
 293                                         param_offset_in + this_param >  cli->bufsize ||
 294                                         param_offset_in + this_param < param_offset_in ||
 295                                         param_offset_in + this_param < this_param) {
 296                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 297                                 goto out;
 298                         }
 299
 300                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 301                 }
 302                 *data_len += this_data;
 303                 *param_len += this_param;
 304
 305                 if (total_data <= *data_len && total_param <= *param_len) {
 306                         ret = True;
 307                         break;
 308                 }
 309
 310                 if (!cli_receive_smb(cli)) {
 311                         goto out;
 312                 }
 313
 314                 show_msg(cli->inbuf);
 315
 316                 /* sanity check */
 317                 if (CVAL(cli->inbuf,smb_com) != trans) {
 318                         DEBUG(0,("Expected %s response, got command 0x%02x\n",
 319                                  trans==SMBtrans?"SMBtrans":"SMBtrans2",
 320                                  CVAL(cli->inbuf,smb_com)));
 321                         goto out;
 322                 }
 323                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 324                         if (NT_STATUS_IS_ERR(cli_nt_error(cli))) {
 325                                 goto out;
 326                         }
 327                 }
 328
 329                 /* parse out the total lengths again - they can shrink! */
 330                 if (SVAL(cli->inbuf,smb_tdrcnt) < total_data)
 331                         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 332                 if (SVAL(cli->inbuf,smb_tprcnt) < total_param)
 333                         total_param = SVAL(cli->inbuf,smb_tprcnt);
 334
 335                 if (total_data <= *data_len && total_param <= *param_len) {
 336                         ret = True;
 337                         break;
 338                 }
 339         }
 340
 341   out:
 342
 343         if (ret) {
 344                 /* Ensure the last 2 bytes of param and data are 2 null
 345                  * bytes. These are malloc'ed, but not included in any
 346                  * length counts. This allows cli_XX string reading functions
 347                  * to safely null terminate. */
 348                 if (total_data) {
 349                         SSVAL(*data,total_data,0);
 350                 }
 351                 if (total_param) {
 352                         SSVAL(*param,total_param,0);
 353                 }
 354         }
 355
 356         client_set_trans_sign_state_off(cli, SVAL(cli->inbuf,smb_mid));
 357         return ret;
 358 }
 359
 360 /****************************************************************************
 361  Send a SMB nttrans request.
 362 ****************************************************************************/
 363
 364 bool cli_send_nt_trans(struct cli_state *cli,
 365                        int function,
 366                        int flags,
 367                        uint16 *setup, unsigned int lsetup, unsigned int msetup,
 368                        char *param, unsigned int lparam, unsigned int mparam,
 369                        char *data, unsigned int ldata, unsigned int mdata)
 370 {
 371         unsigned int i;
 372         unsigned int this_ldata,this_lparam;
 373         unsigned int tot_data=0,tot_param=0;
 374         uint16 mid;
 375         char *outdata,*outparam;
 376
 377         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
 378         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
 379
 380         memset(cli->outbuf,'\0',smb_size);
 381         cli_set_message(cli->outbuf,19+lsetup,0,True);
 382         SCVAL(cli->outbuf,smb_com,SMBnttrans);
 383         SSVAL(cli->outbuf,smb_tid, cli->cnum);
 384         cli_setup_packet(cli);
 385
 386         /*
 387          * Save the mid we're using. We need this for finding
 388          * signing replies.
 389          */
 390
 391         mid = cli->mid;
 392
 393         outparam = smb_buf(cli->outbuf)+3;
 394         outdata = outparam+this_lparam;
 395
 396         /* primary request */
 397         SCVAL(cli->outbuf,smb_nt_MaxSetupCount,msetup);
 398         SCVAL(cli->outbuf,smb_nt_Flags,flags);
 399         SIVAL(cli->outbuf,smb_nt_TotalParameterCount, lparam);
 400         SIVAL(cli->outbuf,smb_nt_TotalDataCount, ldata);
 401         SIVAL(cli->outbuf,smb_nt_MaxParameterCount, mparam);
 402         SIVAL(cli->outbuf,smb_nt_MaxDataCount, mdata);
 403         SIVAL(cli->outbuf,smb_nt_ParameterCount, this_lparam);
 404         SIVAL(cli->outbuf,smb_nt_ParameterOffset, smb_offset(outparam,cli->outbuf));
 405         SIVAL(cli->outbuf,smb_nt_DataCount, this_ldata);
 406         SIVAL(cli->outbuf,smb_nt_DataOffset, smb_offset(outdata,cli->outbuf));
 407         SIVAL(cli->outbuf,smb_nt_SetupCount, lsetup);
 408         SIVAL(cli->outbuf,smb_nt_Function, function);
 409         for (i=0;i<lsetup;i++)          /* setup[] */
 410                 SSVAL(cli->outbuf,smb_nt_SetupStart+i*2,setup[i]);
 411
 412         if (this_lparam)                        /* param[] */
 413                 memcpy(outparam,param,this_lparam);
 414         if (this_ldata)                 /* data[] */
 415                 memcpy(outdata,data,this_ldata);
 416
 417         cli_setup_bcc(cli, outdata+this_ldata);
 418
 419         show_msg(cli->outbuf);
 420         if (!cli_send_smb(cli)) {
 421                 return False;
 422         }
 423
 424         /* Note we're in a trans state. Save the sequence
 425          * numbers for replies. */
 426         client_set_trans_sign_state_on(cli, mid);
 427
 428         if (this_ldata < ldata || this_lparam < lparam) {
 429                 /* receive interim response */
 430                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
 431                         client_set_trans_sign_state_off(cli, mid);
 432                         return(False);
 433                 }
 434
 435                 tot_data = this_ldata;
 436                 tot_param = this_lparam;
 437
 438                 while (tot_data < ldata || tot_param < lparam)  {
 439                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 440                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 441
 442                         cli_set_message(cli->outbuf,18,0,True);
 443                         SCVAL(cli->outbuf,smb_com,SMBnttranss);
 444
 445                         /* XXX - these should probably be aligned */
 446                         outparam = smb_buf(cli->outbuf);
 447                         outdata = outparam+this_lparam;
 448
 449                         /* secondary request */
 450                         SIVAL(cli->outbuf,smb_nts_TotalParameterCount,lparam);
 451                         SIVAL(cli->outbuf,smb_nts_TotalDataCount,ldata);
 452                         SIVAL(cli->outbuf,smb_nts_ParameterCount,this_lparam);
 453                         SIVAL(cli->outbuf,smb_nts_ParameterOffset,smb_offset(outparam,cli->outbuf));
 454                         SIVAL(cli->outbuf,smb_nts_ParameterDisplacement,tot_param);
 455                         SIVAL(cli->outbuf,smb_nts_DataCount,this_ldata);
 456                         SIVAL(cli->outbuf,smb_nts_DataOffset,smb_offset(outdata,cli->outbuf));
 457                         SIVAL(cli->outbuf,smb_nts_DataDisplacement,tot_data);
 458                         if (this_lparam)                        /* param[] */
 459                                 memcpy(outparam,param+tot_param,this_lparam);
 460                         if (this_ldata)                 /* data[] */
 461                                 memcpy(outdata,data+tot_data,this_ldata);
 462                         cli_setup_bcc(cli, outdata+this_ldata);
 463
 464                         /*
 465                          * Save the mid we're using. We need this for finding
 466                          * signing replies.
 467                          */
 468                         mid = cli->mid;
 469
 470                         show_msg(cli->outbuf);
 471
 472                         if (!cli_send_smb(cli)) {
 473                                 client_set_trans_sign_state_off(cli, mid);
 474                                 return False;
 475                         }
 476
 477                         /* Ensure we use the same mid for the secondaries. */
 478                         cli->mid = mid;
 479
 480                         tot_data += this_ldata;
 481                         tot_param += this_lparam;
 482                 }
 483         }
 484
 485         return(True);
 486 }
 487
 488 /****************************************************************************
 489  Receive a SMB nttrans response allocating the necessary memory.
 490 ****************************************************************************/
 491
 492 bool cli_receive_nt_trans(struct cli_state *cli,
 493                           char **param, unsigned int *param_len,
 494                           char **data, unsigned int *data_len)
 495 {
 496         unsigned int total_data=0;
 497         unsigned int total_param=0;
 498         unsigned int this_data,this_param;
 499         uint8 eclass;
 500         uint32 ecode;
 501         bool ret = False;
 502
 503         *data_len = *param_len = 0;
 504
 505         if (!cli_receive_smb(cli)) {
 506                 return False;
 507         }
 508
 509         show_msg(cli->inbuf);
 510
 511         /* sanity check */
 512         if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 513                 DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 514                          CVAL(cli->inbuf,smb_com)));
 515                 return(False);
 516         }
 517
 518         /*
 519          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 520          * to a trans call. This is not an error and should not
 521          * be treated as such.
 522          */
 523         if (cli_is_dos_error(cli)) {
 524                 cli_dos_error(cli, &eclass, &ecode);
 525                 if (!(eclass == ERRDOS && ecode == ERRmoredata)) {
 526                         goto out;
 527                 }
 528         }
 529
 530         /*
 531          * Likewise for NT_STATUS_BUFFER_TOO_SMALL
 532          */
 533         if (cli_is_nt_error(cli)) {
 534                 if (!NT_STATUS_EQUAL(cli_nt_error(cli),
 535                                      NT_STATUS_BUFFER_TOO_SMALL)) {
 536                         goto out;
 537                 }
 538         }
 539
 540         /* parse out the lengths */
 541         total_data = IVAL(cli->inbuf,smb_ntr_TotalDataCount);
 542         total_param = IVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 543         /* Only allow 16 megs. */
 544         if (total_param > 16*1024*1024) {
 545                 DEBUG(0,("cli_receive_nt_trans: param buffer too large %d\n",
 546                                         total_param));
 547                 goto out;
 548         }
 549         if (total_data > 16*1024*1024) {
 550                 DEBUG(0,("cli_receive_nt_trans: data buffer too large %d\n",
 551                                         total_data));
 552                 goto out;
 553         }
 554
 555         /* allocate it */
 556         if (total_data) {
 557                 /* We know adding 2 is safe as total_data is less
 558                  * than 16mb (above). */
 559                 *data = (char *)SMB_REALLOC(*data,total_data+2);
 560                 if (!(*data)) {
 561                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge data buffer to %d\n",total_data));
 562                         goto out;
 563                 }
 564         }
 565
 566         if (total_param) {
 567                 /* We know adding 2 is safe as total_param is less
 568                  * than 16mb (above). */
 569                 *param = (char *)SMB_REALLOC(*param,total_param+2);
 570                 if (!(*param)) {
 571                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge param buffer to %d\n", total_param));
 572                         goto out;
 573                 }
 574         }
 575
 576         while (1)  {
 577                 this_data = SVAL(cli->inbuf,smb_ntr_DataCount);
 578                 this_param = SVAL(cli->inbuf,smb_ntr_ParameterCount);
 579
 580                 if (this_data + *data_len > total_data ||
 581                     this_param + *param_len > total_param) {
 582                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 583                         goto out;
 584                 }
 585
 586                 if (this_data + *data_len < this_data ||
 587                                 this_data + *data_len < *data_len ||
 588                                 this_param + *param_len < this_param ||
 589                                 this_param + *param_len < *param_len) {
 590                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 591                         goto out;
 592                 }
 593
 594                 if (this_data) {
 595                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_ntr_DataDisplacement);
 596                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_ntr_DataOffset);
 597
 598                         if (data_offset_out > total_data ||
 599                                         data_offset_out + this_data > total_data ||
 600                                         data_offset_out + this_data < data_offset_out ||
 601                                         data_offset_out + this_data < this_data) {
 602                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 603                                 goto out;
 604                         }
 605                         if (data_offset_in > cli->bufsize ||
 606                                         data_offset_in + this_data >  cli->bufsize ||
 607                                         data_offset_in + this_data < data_offset_in ||
 608                                         data_offset_in + this_data < this_data) {
 609                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 610                                 goto out;
 611                         }
 612
 613                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 614                 }
 615
 616                 if (this_param) {
 617                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_ntr_ParameterDisplacement);
 618                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_ntr_ParameterOffset);
 619
 620                         if (param_offset_out > total_param ||
 621                                         param_offset_out + this_param > total_param ||
 622                                         param_offset_out + this_param < param_offset_out ||
 623                                         param_offset_out + this_param < this_param) {
 624                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 625                                 goto out;
 626                         }
 627                         if (param_offset_in > cli->bufsize ||
 628                                         param_offset_in + this_param >  cli->bufsize ||
 629                                         param_offset_in + this_param < param_offset_in ||
 630                                         param_offset_in + this_param < this_param) {
 631                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 632                                 goto out;
 633                         }
 634
 635                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 636                 }
 637
 638                 *data_len += this_data;
 639                 *param_len += this_param;
 640
 641                 if (total_data <= *data_len && total_param <= *param_len) {
 642                         ret = True;
 643                         break;
 644                 }
 645
 646                 if (!cli_receive_smb(cli)) {
 647                         goto out;
 648                 }
 649
 650                 show_msg(cli->inbuf);
 651
 652                 /* sanity check */
 653                 if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 654                         DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 655                                  CVAL(cli->inbuf,smb_com)));
 656                         goto out;
 657                 }
 658                 if (cli_is_dos_error(cli)) {
 659                         cli_dos_error(cli, &eclass, &ecode);
 660                         if(!(eclass == ERRDOS && ecode == ERRmoredata)) {
 661                                 goto out;
 662                         }
 663                 }
 664                 /*
 665                  * Likewise for NT_STATUS_BUFFER_TOO_SMALL
 666                  */
 667                 if (cli_is_nt_error(cli)) {
 668                         if (!NT_STATUS_EQUAL(cli_nt_error(cli),
 669                                              NT_STATUS_BUFFER_TOO_SMALL)) {
 670                                 goto out;
 671                         }
 672                 }
 673
 674                 /* parse out the total lengths again - they can shrink! */
 675                 if (IVAL(cli->inbuf,smb_ntr_TotalDataCount) < total_data)
 676                         total_data = IVAL(cli->inbuf,smb_ntr_TotalDataCount);
 677                 if (IVAL(cli->inbuf,smb_ntr_TotalParameterCount) < total_param)
 678                         total_param = IVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 679
 680                 if (total_data <= *data_len && total_param <= *param_len) {
 681                         ret = True;
 682                         break;
 683                 }
 684         }
 685
 686   out:
 687
 688         if (ret) {
 689                 /* Ensure the last 2 bytes of param and data are 2 null
 690                  * bytes. These are malloc'ed, but not included in any
 691                  * length counts. This allows cli_XX string reading functions
 692                  * to safely null terminate. */
 693                 if (total_data) {
 694                         SSVAL(*data,total_data,0);
 695                 }
 696                 if (total_param) {
 697                         SSVAL(*param,total_param,0);
 698                 }
 699         }
 700
 701         client_set_trans_sign_state_off(cli, SVAL(cli->inbuf,smb_mid));
 702         return ret;
 703 }