s3:smbd: Fix converity warning with _smb_setlen_large()
[metze/samba/wip.git] / source3 / smbd / reply.c
index 030f011157602bdbc8e7f21dc59d3be6fa17813b..fc56e3234be6b3916c50f6cb3451197edf03139d 100644 (file)
@@ -25,6 +25,7 @@
 */
 
 #include "includes.h"
+#include "libsmb/namequery.h"
 #include "system/filesys.h"
 #include "printing.h"
 #include "smbd/smbd.h"
@@ -190,16 +191,16 @@ static NTSTATUS check_path_syntax_internal(char *path,
                        switch(siz) {
                                case 5:
                                        *d++ = *s++;
-                                       /*fall through*/
+                                       FALL_THROUGH;
                                case 4:
                                        *d++ = *s++;
-                                       /*fall through*/
+                                       FALL_THROUGH;
                                case 3:
                                        *d++ = *s++;
-                                       /*fall through*/
+                                       FALL_THROUGH;
                                case 2:
                                        *d++ = *s++;
-                                       /*fall through*/
+                                       FALL_THROUGH;
                                case 1:
                                        *d++ = *s++;
                                        break;
@@ -923,6 +924,11 @@ void reply_tcon_and_X(struct smb_request *req)
                }
 
                TALLOC_FREE(tcon);
+               /*
+                * This tree id is gone. Make sure we can't re-use it
+                * by accident.
+                */
+               req->tid = 0;
        }
 
        if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
@@ -1278,7 +1284,7 @@ void reply_checkpath(struct smb_request *req)
        struct smb_filename *smb_fname = NULL;
        char *name = NULL;
        NTSTATUS status;
-       uint32_t ucf_flags = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
+       uint32_t ucf_flags = ucf_flags_from_smb_request(req);
        TALLOC_CTX *ctx = talloc_tos();
 
        START_PROFILE(SMBcheckpath);
@@ -1297,7 +1303,6 @@ void reply_checkpath(struct smb_request *req)
 
        status = filename_convert(ctx,
                                conn,
-                               req->flags2 & FLAGS2_DFS_PATHNAMES,
                                name,
                                ucf_flags,
                                NULL,
@@ -1393,11 +1398,9 @@ void reply_getatr(struct smb_request *req)
                size = 0;
                mtime = 0;
        } else {
-               uint32_t ucf_flags = (req->posix_pathnames ?
-                               UCF_POSIX_PATHNAMES : 0);
+               uint32_t ucf_flags = ucf_flags_from_smb_request(req);
                status = filename_convert(ctx,
                                conn,
-                               req->flags2 & FLAGS2_DFS_PATHNAMES,
                                fname,
                                ucf_flags,
                                NULL,
@@ -1480,7 +1483,7 @@ void reply_setatr(struct smb_request *req)
        time_t mtime;
        const char *p;
        NTSTATUS status;
-       uint32_t ucf_flags = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
+       uint32_t ucf_flags = ucf_flags_from_smb_request(req);
        TALLOC_CTX *ctx = talloc_tos();
 
        START_PROFILE(SMBsetatr);
@@ -1501,7 +1504,6 @@ void reply_setatr(struct smb_request *req)
 
        status = filename_convert(ctx,
                                conn,
-                               req->flags2 & FLAGS2_DFS_PATHNAMES,
                                fname,
                                ucf_flags,
                                NULL,
@@ -1798,9 +1800,8 @@ void reply_search(struct smb_request *req)
        if (status_len == 0) {
                struct smb_filename *smb_dname = NULL;
                uint32_t ucf_flags = UCF_ALWAYS_ALLOW_WCARD_LCOMP |
-                       (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
+                       ucf_flags_from_smb_request(req);
                nt_status = filename_convert(ctx, conn,
-                                            req->flags2 & FLAGS2_DFS_PATHNAMES,
                                             path,
                                             ucf_flags,
                                             &mask_contains_wcard,
@@ -1901,9 +1902,6 @@ void reply_search(struct smb_request *req)
 
        DEBUG(4,("dptr_num is %d\n",dptr_num));
 
-       /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
-       dptr_init_search_op(dirptr);
-
        if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
                char buf[DIR_STRUCT_SIZE];
                memcpy(buf,status,21);
@@ -2146,7 +2144,6 @@ void reply_open(struct smb_request *req)
 
        status = filename_convert(ctx,
                                conn,
-                               req->flags2 & FLAGS2_DFS_PATHNAMES,
                                fname,
                                ucf_flags,
                                NULL,
@@ -2319,7 +2316,6 @@ void reply_open_and_X(struct smb_request *req)
 
        status = filename_convert(ctx,
                                conn,
-                               req->flags2 & FLAGS2_DFS_PATHNAMES,
                                fname,
                                ucf_flags,
                                NULL,
@@ -2564,7 +2560,6 @@ void reply_mknew(struct smb_request *req)
        ucf_flags = filename_create_ucf_flags(req, create_disposition);
        status = filename_convert(ctx,
                                conn,
-                               req->flags2 & FLAGS2_DFS_PATHNAMES,
                                fname,
                                ucf_flags,
                                NULL,
@@ -2701,7 +2696,6 @@ void reply_ctemp(struct smb_request *req)
 
                ucf_flags = filename_create_ucf_flags(req, FILE_CREATE);
                status = filename_convert(ctx, conn,
-                               req->flags2 & FLAGS2_DFS_PATHNAMES,
                                fname,
                                ucf_flags,
                                NULL,
@@ -3062,7 +3056,7 @@ NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
                        dirtype = FILE_ATTRIBUTE_NORMAL;
                }
 
-               status = check_name(conn, smb_fname->base_name);
+               status = check_name(conn, smb_fname);
                if (!NT_STATUS_IS_OK(status)) {
                        goto out;
                }
@@ -3096,11 +3090,6 @@ NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
                        }
                }
 
-               status = check_name(conn, fname_dir);
-               if (!NT_STATUS_IS_OK(status)) {
-                       goto out;
-               }
-
                smb_fname_dir = synthetic_smb_fname(talloc_tos(),
                                        fname_dir,
                                        NULL,
@@ -3111,6 +3100,11 @@ NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
                        goto out;
                }
 
+               status = check_name(conn, smb_fname_dir);
+               if (!NT_STATUS_IS_OK(status)) {
+                       goto out;
+               }
+
                dir_hnd = OpenDir(talloc_tos(), conn, smb_fname_dir, fname_mask,
                                  dirtype);
                if (dir_hnd == NULL) {
@@ -3170,7 +3164,7 @@ NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
                                goto out;
                        }
 
-                       status = check_name(conn, smb_fname->base_name);
+                       status = check_name(conn, smb_fname);
                        if (!NT_STATUS_IS_OK(status)) {
                                TALLOC_FREE(dir_hnd);
                                TALLOC_FREE(frame);
@@ -3220,7 +3214,7 @@ void reply_unlink(struct smb_request *req)
        NTSTATUS status;
        bool path_contains_wcard = False;
        uint32_t ucf_flags = UCF_COND_ALLOW_WCARD_LCOMP |
-                       (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
+                       ucf_flags_from_smb_request(req);
        TALLOC_CTX *ctx = talloc_tos();
 
        START_PROFILE(SMBunlink);
@@ -3241,7 +3235,6 @@ void reply_unlink(struct smb_request *req)
        }
 
        status = filename_convert(ctx, conn,
-                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                  name,
                                  ucf_flags,
                                  &path_contains_wcard,
@@ -3689,7 +3682,7 @@ void reply_readbraw(struct smb_request *req)
            (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
            &lock);
 
-       if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
+       if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
                reply_readbraw_error(xconn);
                END_PROFILE(SMBreadbraw);
                return;
@@ -3721,8 +3714,6 @@ void reply_readbraw(struct smb_request *req)
 
        DEBUG(5,("reply_readbraw finished\n"));
 
-       SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
-
        END_PROFILE(SMBreadbraw);
        return;
 }
@@ -3902,7 +3893,7 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
            (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
            &lock);
 
-       if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
+       if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
                reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
                END_PROFILE(SMBread);
                return;
@@ -3913,7 +3904,7 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
 
        if (nread < 0) {
                reply_nterror(req, map_nt_error_from_unix(errno));
-               goto strict_unlock;
+               goto out;
        }
 
        srv_set_message((char *)req->outbuf, 5, nread+3, False);
@@ -3926,9 +3917,7 @@ Returning short read of maximum allowed for compatibility with Windows 2000.\n",
        DEBUG(3, ("read %s num=%d nread=%d\n",
                  fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
 
-strict_unlock:
-       SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
-
+out:
        END_PROFILE(SMBread);
        return;
 }
@@ -3937,9 +3926,9 @@ strict_unlock:
  Setup readX header.
 ****************************************************************************/
 
-int setup_readX_header(char *outbuf, size_t smb_maxcnt)
+size_t setup_readX_header(char *outbuf, size_t smb_maxcnt)
 {
-       int outsize;
+       size_t outsize;
 
        outsize = srv_set_message(outbuf,12,smb_maxcnt + 1 /* padding byte */,
                                  False);
@@ -3980,7 +3969,7 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
            (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
            &lock);
 
-       if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
+       if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
                reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
                return;
        }
@@ -4001,7 +3990,7 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
 
                if(fsp_stat(fsp) == -1) {
                        reply_nterror(req, map_nt_error_from_unix(errno));
-                       goto strict_unlock;
+                       goto out;
                }
 
                if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
@@ -4063,7 +4052,7 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
                                DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
                                          fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
                                /* No outbuf here means successful sendfile. */
-                               goto strict_unlock;
+                               goto out;
                        }
 
                        DEBUG(0,("send_file_readX: sendfile failed for file "
@@ -4104,7 +4093,7 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
                /* No outbuf here means successful sendfile. */
                SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
                SMB_PERFCOUNT_END(&req->pcd);
-               goto strict_unlock;
+               goto out;
        }
 
 normal_read:
@@ -4154,7 +4143,7 @@ normal_read:
                        errno = saved_errno;
                        exit_server_cleanly("send_file_readX: fake_sendfile failed");
                }
-               goto strict_unlock;
+               goto out;
        }
 
 nosendfile_read:
@@ -4167,8 +4156,6 @@ nosendfile_read:
                          startpos, smb_maxcnt);
        saved_errno = errno;
 
-       SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
-
        if (nread < 0) {
                reply_nterror(req, map_nt_error_from_unix(saved_errno));
                return;
@@ -4180,8 +4167,7 @@ nosendfile_read:
                  fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
        return;
 
- strict_unlock:
-       SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+out:
        TALLOC_FREE(req->outbuf);
        return;
 }
@@ -4491,6 +4477,9 @@ void reply_writebraw(struct smb_request *req)
        }
 
        /* Ensure we don't write bytes past the end of this packet. */
+       /*
+        * This already protects us against CVE-2017-12163.
+        */
        if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                error_to_writebrawerr(req);
@@ -4503,7 +4492,7 @@ void reply_writebraw(struct smb_request *req)
                    (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
                    &lock);
 
-               if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
+               if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
                        reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
                        error_to_writebrawerr(req);
                        END_PROFILE(SMBwritebraw);
@@ -4523,7 +4512,7 @@ void reply_writebraw(struct smb_request *req)
        if (nwritten < (ssize_t)numtowrite)  {
                reply_nterror(req, NT_STATUS_DISK_FULL);
                error_to_writebrawerr(req);
-               goto strict_unlock;
+               goto out;
        }
 
        total_written = nwritten;
@@ -4533,7 +4522,7 @@ void reply_writebraw(struct smb_request *req)
        if (!buf) {
                reply_nterror(req, NT_STATUS_NO_MEMORY);
                error_to_writebrawerr(req);
-               goto strict_unlock;
+               goto out;
        }
 
        /* Return a SMBwritebraw message to the redirector to tell
@@ -4591,12 +4580,17 @@ void reply_writebraw(struct smb_request *req)
                        exit_server_cleanly("secondary writebraw failed");
                }
 
+               /*
+                * We are not vulnerable to CVE-2017-12163
+                * here as we are guarenteed to have numtowrite
+                * bytes available - we just read from the client.
+                */
                nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
                if (nwritten == -1) {
                        TALLOC_FREE(buf);
                        reply_nterror(req, map_nt_error_from_unix(errno));
                        error_to_writebrawerr(req);
-                       goto strict_unlock;
+                       goto out;
                }
 
                if (nwritten < (ssize_t)numtowrite) {
@@ -4618,7 +4612,7 @@ void reply_writebraw(struct smb_request *req)
                         fsp_str_dbg(fsp), nt_errstr(status)));
                reply_nterror(req, status);
                error_to_writebrawerr(req);
-               goto strict_unlock;
+               goto out;
        }
 
        DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
@@ -4626,10 +4620,6 @@ void reply_writebraw(struct smb_request *req)
                fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
                (int)total_written));
 
-       if (!fsp->print_file) {
-               SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
-       }
-
        /* We won't return a status if write through is not selected - this
         * follows what WfWg does */
        END_PROFILE(SMBwritebraw);
@@ -4651,11 +4641,7 @@ void reply_writebraw(struct smb_request *req)
        }
        return;
 
-strict_unlock:
-       if (!fsp->print_file) {
-               SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
-       }
-
+out:
        END_PROFILE(SMBwritebraw);
        return;
 }
@@ -4672,6 +4658,7 @@ void reply_writeunlock(struct smb_request *req)
        connection_struct *conn = req->conn;
        ssize_t nwritten = -1;
        size_t numtowrite;
+       size_t remaining;
        off_t startpos;
        const char *data;
        NTSTATUS status = NT_STATUS_OK;
@@ -4704,12 +4691,23 @@ void reply_writeunlock(struct smb_request *req)
        startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
        data = (const char *)req->buf + 3;
 
+       /*
+        * Ensure client isn't asking us to write more than
+        * they sent. CVE-2017-12163.
+        */
+       remaining = smbreq_bufrem(req, data);
+       if (numtowrite > remaining) {
+               reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+               END_PROFILE(SMBwriteunlock);
+               return;
+       }
+
        if (!fsp->print_file && numtowrite > 0) {
                init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
                    (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
                    &lock);
 
-               if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
+               if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
                        reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
                        END_PROFILE(SMBwriteunlock);
                        return;
@@ -4731,17 +4729,17 @@ void reply_writeunlock(struct smb_request *req)
                DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
                         fsp_str_dbg(fsp), nt_errstr(status)));
                reply_nterror(req, status);
-               goto strict_unlock;
+               goto out;
        }
 
        if(nwritten < 0) {
                reply_nterror(req, map_nt_error_from_unix(saved_errno));
-               goto strict_unlock;
+               goto out;
        }
 
        if((nwritten < numtowrite) && (numtowrite != 0)) {
                reply_nterror(req, NT_STATUS_DISK_FULL);
-               goto strict_unlock;
+               goto out;
        }
 
        if (numtowrite && !fsp->print_file) {
@@ -4754,7 +4752,7 @@ void reply_writeunlock(struct smb_request *req)
 
                if (NT_STATUS_V(status)) {
                        reply_nterror(req, status);
-                       goto strict_unlock;
+                       goto out;
                }
        }
 
@@ -4765,11 +4763,7 @@ void reply_writeunlock(struct smb_request *req)
        DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
                  fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
 
-strict_unlock:
-       if (numtowrite && !fsp->print_file) {
-               SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
-       }
-
+out:
        END_PROFILE(SMBwriteunlock);
        return;
 }
@@ -4785,6 +4779,7 @@ void reply_write(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
        size_t numtowrite;
+       size_t remaining;
        ssize_t nwritten = -1;
        off_t startpos;
        const char *data;
@@ -4825,12 +4820,23 @@ void reply_write(struct smb_request *req)
        startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
        data = (const char *)req->buf + 3;
 
+       /*
+        * Ensure client isn't asking us to write more than
+        * they sent. CVE-2017-12163.
+        */
+       remaining = smbreq_bufrem(req, data);
+       if (numtowrite > remaining) {
+               reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+               END_PROFILE(SMBwrite);
+               return;
+       }
+
        if (!fsp->print_file) {
                init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
                        (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
                        &lock);
 
-               if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
+               if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
                        reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
                        END_PROFILE(SMBwrite);
                        return;
@@ -4850,12 +4856,12 @@ void reply_write(struct smb_request *req)
                nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
                if (nwritten < 0) {
                        reply_nterror(req, NT_STATUS_DISK_FULL);
-                       goto strict_unlock;
+                       goto out;
                }
                nwritten = vfs_set_filelen(fsp, (off_t)startpos);
                if (nwritten < 0) {
                        reply_nterror(req, NT_STATUS_DISK_FULL);
-                       goto strict_unlock;
+                       goto out;
                }
                trigger_write_time_update_immediate(fsp);
        } else {
@@ -4867,17 +4873,17 @@ void reply_write(struct smb_request *req)
                DEBUG(5,("reply_write: sync_file for %s returned %s\n",
                         fsp_str_dbg(fsp), nt_errstr(status)));
                reply_nterror(req, status);
-               goto strict_unlock;
+               goto out;
        }
 
        if(nwritten < 0) {
                reply_nterror(req, map_nt_error_from_unix(saved_errno));
-               goto strict_unlock;
+               goto out;
        }
 
        if((nwritten == 0) && (numtowrite != 0)) {
                reply_nterror(req, NT_STATUS_DISK_FULL);
-               goto strict_unlock;
+               goto out;
        }
 
        reply_outbuf(req, 1, 0);
@@ -4891,11 +4897,7 @@ void reply_write(struct smb_request *req)
 
        DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
 
-strict_unlock:
-       if (!fsp->print_file) {
-               SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
-       }
-
+out:
        END_PROFILE(SMBwrite);
        return;
 }
@@ -5051,6 +5053,9 @@ void reply_write_and_X(struct smb_request *req)
                        goto out;
                }
        } else {
+               /*
+                * This already protects us against CVE-2017-12163.
+                */
                if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
                                smb_doff + numtowrite > smblen) {
                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -5123,15 +5128,13 @@ void reply_write_and_X(struct smb_request *req)
                    (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
                    &lock);
 
-               if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
+               if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
                        reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
                        goto out;
                }
 
                nwritten = write_file(req,fsp,data,startpos,numtowrite);
                saved_errno = errno;
-
-               SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
        }
 
        if(nwritten < 0) {
@@ -5479,6 +5482,7 @@ void reply_writeclose(struct smb_request *req)
 {
        connection_struct *conn = req->conn;
        size_t numtowrite;
+       size_t remaining;
        ssize_t nwritten = -1;
        NTSTATUS close_status = NT_STATUS_OK;
        off_t startpos;
@@ -5512,12 +5516,23 @@ void reply_writeclose(struct smb_request *req)
        mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
        data = (const char *)req->buf + 1;
 
+       /*
+        * Ensure client isn't asking us to write more than
+        * they sent. CVE-2017-12163.
+        */
+       remaining = smbreq_bufrem(req, data);
+       if (numtowrite > remaining) {
+               reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+               END_PROFILE(SMBwriteclose);
+               return;
+       }
+
        if (fsp->print_file == NULL) {
                init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
                    (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
                    &lock);
 
-               if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
+               if (!SMB_VFS_STRICT_LOCK_CHECK(conn, fsp, &lock)) {
                        reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
                        END_PROFILE(SMBwriteclose);
                        return;
@@ -5526,10 +5541,6 @@ void reply_writeclose(struct smb_request *req)
 
        nwritten = write_file(req,fsp,data,startpos,numtowrite);
 
-       if (fsp->print_file == NULL) {
-               SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
-       }
-
        set_close_write_time(fsp, mtime);
 
        /*
@@ -5952,7 +5963,7 @@ void reply_printqueue(struct smb_request *req)
 
                ZERO_STRUCT(handle);
 
-               status = rpc_pipe_open_interface(conn,
+               status = rpc_pipe_open_interface(mem_ctx,
                                                 &ndr_table_spoolss,
                                                 conn->session_info,
                                                 conn->sconn->remote_address,
@@ -6108,6 +6119,9 @@ void reply_printwrite(struct smb_request *req)
 
        numtowrite = SVAL(req->buf, 1);
 
+       /*
+        * This already protects us against CVE-2017-12163.
+        */
        if (req->buflen < numtowrite + 3) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                END_PROFILE(SMBsplwr);
@@ -6152,7 +6166,6 @@ void reply_mkdir(struct smb_request *req)
 
        ucf_flags = filename_create_ucf_flags(req, FILE_CREATE);
        status = filename_convert(ctx, conn,
-                                req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 directory,
                                 ucf_flags,
                                 NULL,
@@ -6210,7 +6223,7 @@ void reply_rmdir(struct smb_request *req)
        TALLOC_CTX *ctx = talloc_tos();
        files_struct *fsp = NULL;
        int info = 0;
-       uint32_t ucf_flags = (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
+       uint32_t ucf_flags = ucf_flags_from_smb_request(req);
        struct smbd_server_connection *sconn = req->sconn;
 
        START_PROFILE(SMBrmdir);
@@ -6223,7 +6236,6 @@ void reply_rmdir(struct smb_request *req)
        }
 
        status = filename_convert(ctx, conn,
-                                req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 directory,
                                 ucf_flags,
                                 NULL,
@@ -6621,7 +6633,7 @@ NTSTATUS rename_internals_fsp(connection_struct *conn,
        uint32_t access_mask = SEC_DIR_ADD_FILE;
        bool dst_exists, old_is_stream, new_is_stream;
 
-       status = check_name(conn, smb_fname_dst_in->base_name);
+       status = check_name(conn, smb_fname_dst_in);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -7100,11 +7112,6 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
                }
        }
 
-       status = check_name(conn, fname_src_dir);
-       if (!NT_STATUS_IS_OK(status)) {
-               goto out;
-       }
-
        smb_fname_src_dir = synthetic_smb_fname(talloc_tos(),
                                fname_src_dir,
                                NULL,
@@ -7115,6 +7122,11 @@ NTSTATUS rename_internals(TALLOC_CTX *ctx,
                goto out;
        }
 
+       status = check_name(conn, smb_fname_src_dir);
+       if (!NT_STATUS_IS_OK(status)) {
+               goto out;
+       }
+
        dir_hnd = OpenDir(talloc_tos(), conn, smb_fname_src_dir, fname_src_mask,
                          attrs);
        if (dir_hnd == NULL) {
@@ -7294,12 +7306,15 @@ void reply_mv(struct smb_request *req)
        TALLOC_CTX *ctx = talloc_tos();
        struct smb_filename *smb_fname_src = NULL;
        struct smb_filename *smb_fname_dst = NULL;
-       uint32_t src_ucf_flags = (req->posix_pathnames ?
-               (UCF_UNIX_NAME_LOOKUP|UCF_POSIX_PATHNAMES) :
-               UCF_COND_ALLOW_WCARD_LCOMP);
-       uint32_t dst_ucf_flags = UCF_SAVE_LCOMP |
-               (req->posix_pathnames ? UCF_POSIX_PATHNAMES :
-                UCF_COND_ALLOW_WCARD_LCOMP);
+       uint32_t src_ucf_flags = ucf_flags_from_smb_request(req) |
+               (req->posix_pathnames ?
+                       UCF_UNIX_NAME_LOOKUP :
+                       UCF_COND_ALLOW_WCARD_LCOMP);
+       uint32_t dst_ucf_flags = ucf_flags_from_smb_request(req) |
+               UCF_SAVE_LCOMP |
+               (req->posix_pathnames ?
+                       0 :
+                       UCF_COND_ALLOW_WCARD_LCOMP);
        bool stream_rename = false;
 
        START_PROFILE(SMBmv);
@@ -7340,7 +7355,6 @@ void reply_mv(struct smb_request *req)
 
        status = filename_convert(ctx,
                                  conn,
-                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                  name,
                                  src_ucf_flags,
                                  &src_has_wcard,
@@ -7358,7 +7372,6 @@ void reply_mv(struct smb_request *req)
 
        status = filename_convert(ctx,
                                  conn,
-                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                  newname,
                                  dst_ucf_flags,
                                  &dest_has_wcard,
@@ -7612,9 +7625,9 @@ void reply_copy(struct smb_request *req)
        bool dest_has_wild = False;
        NTSTATUS status;
        uint32_t ucf_flags_src = UCF_COND_ALLOW_WCARD_LCOMP |
-               (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
+               ucf_flags_from_smb_request(req);
        uint32_t ucf_flags_dst = UCF_COND_ALLOW_WCARD_LCOMP |
-               (req->posix_pathnames ? UCF_POSIX_PATHNAMES : 0);
+               ucf_flags_from_smb_request(req);
        TALLOC_CTX *ctx = talloc_tos();
 
        START_PROFILE(SMBcopy);
@@ -7652,7 +7665,6 @@ void reply_copy(struct smb_request *req)
        }
 
        status = filename_convert(ctx, conn,
-                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                  fname_src,
                                  ucf_flags_src,
                                  &source_has_wild,
@@ -7668,7 +7680,6 @@ void reply_copy(struct smb_request *req)
        }
 
        status = filename_convert(ctx, conn,
-                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                  fname_dst,
                                  ucf_flags_dst,
                                  &dest_has_wild,
@@ -7767,13 +7778,13 @@ void reply_copy(struct smb_request *req)
                        smb_fname_dst->base_name = fname_dst_mod;
                }
 
-               status = check_name(conn, smb_fname_src->base_name);
+               status = check_name(conn, smb_fname_src);
                if (!NT_STATUS_IS_OK(status)) {
                        reply_nterror(req, status);
                        goto out;
                }
 
-               status = check_name(conn, smb_fname_dst->base_name);
+               status = check_name(conn, smb_fname_dst);
                if (!NT_STATUS_IS_OK(status)) {
                        reply_nterror(req, status);
                        goto out;
@@ -7815,12 +7826,6 @@ void reply_copy(struct smb_request *req)
                        }
                }
 
-               status = check_name(conn, fname_src_dir);
-               if (!NT_STATUS_IS_OK(status)) {
-                       reply_nterror(req, status);
-                       goto out;
-               }
-
                smb_fname_src_dir = synthetic_smb_fname(talloc_tos(),
                                        fname_src_dir,
                                        NULL,
@@ -7831,6 +7836,12 @@ void reply_copy(struct smb_request *req)
                        goto out;
                }
 
+               status = check_name(conn, smb_fname_src_dir);
+               if (!NT_STATUS_IS_OK(status)) {
+                       reply_nterror(req, status);
+                       goto out;
+               }
+
                dir_hnd = OpenDir(ctx,
                                conn,
                                smb_fname_src_dir,
@@ -7904,7 +7915,7 @@ void reply_copy(struct smb_request *req)
                        TALLOC_FREE(smb_fname_dst->base_name);
                        smb_fname_dst->base_name = destname;
 
-                       status = check_name(conn, smb_fname_src->base_name);
+                       status = check_name(conn, smb_fname_src);
                        if (!NT_STATUS_IS_OK(status)) {
                                TALLOC_FREE(dir_hnd);
                                TALLOC_FREE(talloced);
@@ -7912,7 +7923,7 @@ void reply_copy(struct smb_request *req)
                                goto out;
                        }
 
-                       status = check_name(conn, smb_fname_dst->base_name);
+                       status = check_name(conn, smb_fname_dst);
                        if (!NT_STATUS_IS_OK(status)) {
                                TALLOC_FREE(dir_hnd);
                                TALLOC_FREE(talloced);