From 5a07c2948146c23d6a907fcd6ce63f67f36a5ded Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Tue, 8 Jan 2019 16:13:41 +0100 Subject: [PATCH] s4:libcli/smb2: calculate the correct credit charge in smb2_ioctl_send() BUG: https://bugzilla.samba.org/show_bug.cgi?id=13863 Signed-off-by: Stefan Metzmacher Reviewed-by: Jeremy Allison --- source4/libcli/smb2/ioctl.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/source4/libcli/smb2/ioctl.c b/source4/libcli/smb2/ioctl.c index b37f750f27d..fe74dfecd8e 100644 --- a/source4/libcli/smb2/ioctl.c +++ b/source4/libcli/smb2/ioctl.c @@ -31,6 +31,9 @@ struct smb2_request *smb2_ioctl_send(struct smb2_tree *tree, struct smb2_ioctl * { NTSTATUS status; struct smb2_request *req; + uint64_t max_payload_in; + uint64_t max_payload_out; + size_t max_payload; req = smb2_request_init_tree(tree, SMB2_OP_IOCTL, 0x38, true, io->in.in.length+io->in.out.length); @@ -57,6 +60,14 @@ struct smb2_request *smb2_ioctl_send(struct smb2_tree *tree, struct smb2_ioctl * SIVAL(req->out.body, 0x2C, io->in.max_output_response); SBVAL(req->out.body, 0x30, io->in.flags); + max_payload_in = io->in.out.length + io->in.in.length; + max_payload_in = MIN(max_payload_in, UINT32_MAX); + max_payload_out = io->in.max_input_response + io->in.max_output_response; + max_payload_out = MIN(max_payload_out, UINT32_MAX); + + max_payload = MAX(max_payload_in, max_payload_out); + req->credit_charge = (MAX(max_payload, 1) - 1)/ 65536 + 1; + smb2_transport_send(req); return req; -- 2.34.1