source/libsmb/clitrans.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client transaction calls
   4    Copyright (C) Andrew Tridgell 1994-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 */
  20
  21 #define NO_SYSLOG
  22
  23 #include "includes.h"
  24
  25
  26 /****************************************************************************
  27  Send a SMB trans or trans2 request.
  28 ****************************************************************************/
  29
  30 BOOL cli_send_trans(struct cli_state *cli, int trans,
  31                     const char *pipe_name,
  32                     int fid, int flags,
  33                     uint16 *setup, unsigned int lsetup, unsigned int msetup,
  34                     const char *param, unsigned int lparam, unsigned int mparam,
  35                     const char *data, unsigned int ldata, unsigned int mdata)
  36 {
  37         unsigned int i;
  38         unsigned int this_ldata,this_lparam;
  39         unsigned int tot_data=0,tot_param=0;
  40         char *outdata,*outparam;
  41         char *p;
  42         int pipe_name_len=0;
  43         uint16 mid;
  44
  45         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
  46         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
  47
  48         memset(cli->outbuf,'\0',smb_size);
  49         set_message(cli->outbuf,14+lsetup,0,True);
  50         SCVAL(cli->outbuf,smb_com,trans);
  51         SSVAL(cli->outbuf,smb_tid, cli->cnum);
  52         cli_setup_packet(cli);
  53
  54         /*
  55          * Save the mid we're using. We need this for finding
  56          * signing replies.
  57          */
  58
  59         mid = cli->mid;
  60
  61         if (pipe_name) {
  62                 pipe_name_len = clistr_push(cli, smb_buf(cli->outbuf), pipe_name, -1, STR_TERMINATE);
  63         }
  64
  65         outparam = smb_buf(cli->outbuf)+(trans==SMBtrans ? pipe_name_len : 3);
  66         outdata = outparam+this_lparam;
  67
  68         /* primary request */
  69         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
  70         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
  71         SSVAL(cli->outbuf,smb_mprcnt,mparam);   /* mprcnt */
  72         SSVAL(cli->outbuf,smb_mdrcnt,mdata);    /* mdrcnt */
  73         SCVAL(cli->outbuf,smb_msrcnt,msetup);   /* msrcnt */
  74         SSVAL(cli->outbuf,smb_flags,flags);     /* flags */
  75         SIVAL(cli->outbuf,smb_timeout,0);               /* timeout */
  76         SSVAL(cli->outbuf,smb_pscnt,this_lparam);       /* pscnt */
  77         SSVAL(cli->outbuf,smb_psoff,smb_offset(outparam,cli->outbuf)); /* psoff */
  78         SSVAL(cli->outbuf,smb_dscnt,this_ldata);        /* dscnt */
  79         SSVAL(cli->outbuf,smb_dsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
  80         SCVAL(cli->outbuf,smb_suwcnt,lsetup);   /* suwcnt */
  81         for (i=0;i<lsetup;i++)          /* setup[] */
  82                 SSVAL(cli->outbuf,smb_setup+i*2,setup[i]);
  83         p = smb_buf(cli->outbuf);
  84         if (trans != SMBtrans) {
  85                 *p++ = 0;  /* put in a null smb_name */
  86                 *p++ = 'D'; *p++ = ' '; /* observed in OS/2 */
  87         }
  88         if (this_lparam)                        /* param[] */
  89                 memcpy(outparam,param,this_lparam);
  90         if (this_ldata)                 /* data[] */
  91                 memcpy(outdata,data,this_ldata);
  92         cli_setup_bcc(cli, outdata+this_ldata);
  93
  94         show_msg(cli->outbuf);
  95
  96         if (!cli_send_smb(cli)) {
  97                 return False;
  98         }
  99
 100         if (this_ldata < ldata || this_lparam < lparam) {
 101                 /* receive interim response */
 102                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
 103                         return(False);
 104                 }
 105
 106                 tot_data = this_ldata;
 107                 tot_param = this_lparam;
 108
 109                 while (tot_data < ldata || tot_param < lparam)  {
 110                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 111                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 112
 113                         set_message(cli->outbuf,trans==SMBtrans?8:9,0,True);
 114                         SCVAL(cli->outbuf,smb_com,(trans==SMBtrans ? SMBtranss : SMBtranss2));
 115
 116                         outparam = smb_buf(cli->outbuf);
 117                         outdata = outparam+this_lparam;
 118
 119                         /* secondary request */
 120                         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
 121                         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
 122                         SSVAL(cli->outbuf,smb_spscnt,this_lparam);      /* pscnt */
 123                         SSVAL(cli->outbuf,smb_spsoff,smb_offset(outparam,cli->outbuf)); /* psoff */
 124                         SSVAL(cli->outbuf,smb_spsdisp,tot_param);       /* psdisp */
 125                         SSVAL(cli->outbuf,smb_sdscnt,this_ldata);       /* dscnt */
 126                         SSVAL(cli->outbuf,smb_sdsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
 127                         SSVAL(cli->outbuf,smb_sdsdisp,tot_data);        /* dsdisp */
 128                         if (trans==SMBtrans2)
 129                                 SSVALS(cli->outbuf,smb_sfid,fid);               /* fid */
 130                         if (this_lparam)                        /* param[] */
 131                                 memcpy(outparam,param+tot_param,this_lparam);
 132                         if (this_ldata)                 /* data[] */
 133                                 memcpy(outdata,data+tot_data,this_ldata);
 134                         cli_setup_bcc(cli, outdata+this_ldata);
 135
 136                         /*
 137                          * Save the mid we're using. We need this for finding
 138                          * signing replies.
 139                          */
 140                         mid = cli->mid;
 141
 142                         show_msg(cli->outbuf);
 143                         if (!cli_send_smb(cli)) {
 144                                 return False;
 145                         }
 146
 147                         tot_data += this_ldata;
 148                         tot_param += this_lparam;
 149                 }
 150         }
 151
 152         /* Note we're in a trans state. Save the sequence
 153          * numbers for replies. */
 154
 155         cli_signing_trans_start(cli, mid);
 156         return(True);
 157 }
 158
 159 /****************************************************************************
 160  Receive a SMB trans or trans2 response allocating the necessary memory.
 161 ****************************************************************************/
 162
 163 BOOL cli_receive_trans(struct cli_state *cli,int trans,
 164                               char **param, unsigned int *param_len,
 165                               char **data, unsigned int *data_len)
 166 {
 167         unsigned int total_data=0;
 168         unsigned int total_param=0;
 169         unsigned int this_data,this_param;
 170         NTSTATUS status;
 171         char *tdata;
 172         char *tparam;
 173
 174         *data_len = *param_len = 0;
 175
 176         if (!cli_receive_smb(cli)) {
 177                 cli_signing_trans_stop(cli);
 178                 return False;
 179         }
 180
 181         show_msg(cli->inbuf);
 182
 183         /* sanity check */
 184         if (CVAL(cli->inbuf,smb_com) != trans) {
 185                 DEBUG(0,("Expected %s response, got command 0x%02x\n",
 186                          trans==SMBtrans?"SMBtrans":"SMBtrans2",
 187                          CVAL(cli->inbuf,smb_com)));
 188                 cli_signing_trans_stop(cli);
 189                 return(False);
 190         }
 191
 192         /*
 193          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 194          * to a trans call. This is not an error and should not
 195          * be treated as such.
 196          */
 197         status = cli_nt_error(cli);
 198
 199         if (NT_STATUS_IS_ERR(status)) {
 200                 cli_signing_trans_stop(cli);
 201                 return False;
 202         }
 203
 204         /* parse out the lengths */
 205         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 206         total_param = SVAL(cli->inbuf,smb_tprcnt);
 207
 208         /* allocate it */
 209         if (total_data!=0) {
 210                 tdata = Realloc(*data,total_data);
 211                 if (!tdata) {
 212                         DEBUG(0,("cli_receive_trans: failed to enlarge data buffer\n"));
 213                         cli_signing_trans_stop(cli);
 214                         return False;
 215                 }
 216                 else
 217                         *data = tdata;
 218         }
 219
 220         if (total_param!=0) {
 221                 tparam = Realloc(*param,total_param);
 222                 if (!tparam) {
 223                         DEBUG(0,("cli_receive_trans: failed to enlarge param buffer\n"));
 224                         cli_signing_trans_stop(cli);
 225                         return False;
 226                 }
 227                 else
 228                         *param = tparam;
 229         }
 230
 231         for (;;)  {
 232                 this_data = SVAL(cli->inbuf,smb_drcnt);
 233                 this_param = SVAL(cli->inbuf,smb_prcnt);
 234
 235                 if (this_data + *data_len > total_data ||
 236                     this_param + *param_len > total_param) {
 237                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 238                         cli_signing_trans_stop(cli);
 239                         return False;
 240                 }
 241
 242                 if (this_data + *data_len < this_data ||
 243                                 this_data + *data_len < *data_len ||
 244                                 this_param + *param_len < this_param ||
 245                                 this_param + *param_len < *param_len) {
 246                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 247                         cli_signing_trans_stop(cli);
 248                         return False;
 249                 }
 250
 251                 if (this_data) {
 252                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_drdisp);
 253                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_droff);
 254
 255                         if (data_offset_out > total_data ||
 256                                         data_offset_out + this_data > total_data ||
 257                                         data_offset_out + this_data < data_offset_out ||
 258                                         data_offset_out + this_data < this_data) {
 259                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 260                                 cli_signing_trans_stop(cli);
 261                                 return False;
 262                         }
 263                         if (data_offset_in > cli->bufsize ||
 264                                         data_offset_in + this_data >  cli->bufsize ||
 265                                         data_offset_in + this_data < data_offset_in ||
 266                                         data_offset_in + this_data < this_data) {
 267                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 268                                 cli_signing_trans_stop(cli);
 269                                 return False;
 270                         }
 271
 272                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 273                 }
 274                 if (this_param) {
 275                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_prdisp);
 276                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_proff);
 277
 278                         if (param_offset_out > total_param ||
 279                                         param_offset_out + this_param > total_param ||
 280                                         param_offset_out + this_param < param_offset_out ||
 281                                         param_offset_out + this_param < this_param) {
 282                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 283                                 cli_signing_trans_stop(cli);
 284                                 return False;
 285                         }
 286                         if (param_offset_in > cli->bufsize ||
 287                                         param_offset_in + this_param >  cli->bufsize ||
 288                                         param_offset_in + this_param < param_offset_in ||
 289                                         param_offset_in + this_param < this_param) {
 290                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 291                                 cli_signing_trans_stop(cli);
 292                                 return False;
 293                         }
 294
 295                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 296                 }
 297                 *data_len += this_data;
 298                 *param_len += this_param;
 299
 300                 if (total_data <= *data_len && total_param <= *param_len)
 301                         break;
 302
 303                 if (!cli_receive_smb(cli)) {
 304                         cli_signing_trans_stop(cli);
 305                         return False;
 306                 }
 307
 308                 show_msg(cli->inbuf);
 309
 310                 /* sanity check */
 311                 if (CVAL(cli->inbuf,smb_com) != trans) {
 312                         DEBUG(0,("Expected %s response, got command 0x%02x\n",
 313                                  trans==SMBtrans?"SMBtrans":"SMBtrans2",
 314                                  CVAL(cli->inbuf,smb_com)));
 315                         cli_signing_trans_stop(cli);
 316                         return(False);
 317                 }
 318                 if (NT_STATUS_IS_ERR(cli_nt_error(cli))) {
 319                         cli_signing_trans_stop(cli);
 320                         return(False);
 321                 }
 322
 323                 /* parse out the total lengths again - they can shrink! */
 324                 if (SVAL(cli->inbuf,smb_tdrcnt) < total_data)
 325                         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 326                 if (SVAL(cli->inbuf,smb_tprcnt) < total_param)
 327                         total_param = SVAL(cli->inbuf,smb_tprcnt);
 328
 329                 if (total_data <= *data_len && total_param <= *param_len)
 330                         break;
 331
 332         }
 333
 334         cli_signing_trans_stop(cli);
 335         return(True);
 336 }
 337
 338 /****************************************************************************
 339  Send a SMB nttrans request.
 340 ****************************************************************************/
 341
 342 BOOL cli_send_nt_trans(struct cli_state *cli,
 343                        int function,
 344                        int flags,
 345                        uint16 *setup, unsigned int lsetup, unsigned int msetup,
 346                        char *param, unsigned int lparam, unsigned int mparam,
 347                        char *data, unsigned int ldata, unsigned int mdata)
 348 {
 349         unsigned int i;
 350         unsigned int this_ldata,this_lparam;
 351         unsigned int tot_data=0,tot_param=0;
 352         uint16 mid;
 353         char *outdata,*outparam;
 354
 355         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
 356         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
 357
 358         memset(cli->outbuf,'\0',smb_size);
 359         set_message(cli->outbuf,19+lsetup,0,True);
 360         SCVAL(cli->outbuf,smb_com,SMBnttrans);
 361         SSVAL(cli->outbuf,smb_tid, cli->cnum);
 362         cli_setup_packet(cli);
 363
 364         /*
 365          * Save the mid we're using. We need this for finding
 366          * signing replies.
 367          */
 368
 369         mid = cli->mid;
 370
 371         outparam = smb_buf(cli->outbuf)+3;
 372         outdata = outparam+this_lparam;
 373
 374         /* primary request */
 375         SCVAL(cli->outbuf,smb_nt_MaxSetupCount,msetup);
 376         SCVAL(cli->outbuf,smb_nt_Flags,flags);
 377         SIVAL(cli->outbuf,smb_nt_TotalParameterCount, lparam);
 378         SIVAL(cli->outbuf,smb_nt_TotalDataCount, ldata);
 379         SIVAL(cli->outbuf,smb_nt_MaxParameterCount, mparam);
 380         SIVAL(cli->outbuf,smb_nt_MaxDataCount, mdata);
 381         SIVAL(cli->outbuf,smb_nt_ParameterCount, this_lparam);
 382         SIVAL(cli->outbuf,smb_nt_ParameterOffset, smb_offset(outparam,cli->outbuf));
 383         SIVAL(cli->outbuf,smb_nt_DataCount, this_ldata);
 384         SIVAL(cli->outbuf,smb_nt_DataOffset, smb_offset(outdata,cli->outbuf));
 385         SIVAL(cli->outbuf,smb_nt_SetupCount, lsetup);
 386         SIVAL(cli->outbuf,smb_nt_Function, function);
 387         for (i=0;i<lsetup;i++)          /* setup[] */
 388                 SSVAL(cli->outbuf,smb_nt_SetupStart+i*2,setup[i]);
 389
 390         if (this_lparam)                        /* param[] */
 391                 memcpy(outparam,param,this_lparam);
 392         if (this_ldata)                 /* data[] */
 393                 memcpy(outdata,data,this_ldata);
 394
 395         cli_setup_bcc(cli, outdata+this_ldata);
 396
 397         show_msg(cli->outbuf);
 398         if (!cli_send_smb(cli)) {
 399                 return False;
 400         }
 401
 402         if (this_ldata < ldata || this_lparam < lparam) {
 403                 /* receive interim response */
 404                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
 405                         return(False);
 406                 }
 407
 408                 tot_data = this_ldata;
 409                 tot_param = this_lparam;
 410
 411                 while (tot_data < ldata || tot_param < lparam)  {
 412                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 413                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 414
 415                         set_message(cli->outbuf,18,0,True);
 416                         SCVAL(cli->outbuf,smb_com,SMBnttranss);
 417
 418                         /* XXX - these should probably be aligned */
 419                         outparam = smb_buf(cli->outbuf);
 420                         outdata = outparam+this_lparam;
 421
 422                         /* secondary request */
 423                         SIVAL(cli->outbuf,smb_nts_TotalParameterCount,lparam);
 424                         SIVAL(cli->outbuf,smb_nts_TotalDataCount,ldata);
 425                         SIVAL(cli->outbuf,smb_nts_ParameterCount,this_lparam);
 426                         SIVAL(cli->outbuf,smb_nts_ParameterOffset,smb_offset(outparam,cli->outbuf));
 427                         SIVAL(cli->outbuf,smb_nts_ParameterDisplacement,tot_param);
 428                         SIVAL(cli->outbuf,smb_nts_DataCount,this_ldata);
 429                         SIVAL(cli->outbuf,smb_nts_DataOffset,smb_offset(outdata,cli->outbuf));
 430                         SIVAL(cli->outbuf,smb_nts_DataDisplacement,tot_data);
 431                         if (this_lparam)                        /* param[] */
 432                                 memcpy(outparam,param+tot_param,this_lparam);
 433                         if (this_ldata)                 /* data[] */
 434                                 memcpy(outdata,data+tot_data,this_ldata);
 435                         cli_setup_bcc(cli, outdata+this_ldata);
 436
 437                         /*
 438                          * Save the mid we're using. We need this for finding
 439                          * signing replies.
 440                          */
 441                         mid = cli->mid;
 442
 443                         show_msg(cli->outbuf);
 444
 445                         if (!cli_send_smb(cli)) {
 446                                 return False;
 447                         }
 448
 449                         tot_data += this_ldata;
 450                         tot_param += this_lparam;
 451                 }
 452         }
 453
 454         /* Note we're in a trans state. Save the sequence
 455          * numbers for replies. */
 456
 457         cli_signing_trans_start(cli, mid);
 458         return(True);
 459 }
 460
 461 /****************************************************************************
 462   receive a SMB nttrans response allocating the necessary memory
 463   ****************************************************************************/
 464
 465 BOOL cli_receive_nt_trans(struct cli_state *cli,
 466                           char **param, unsigned int *param_len,
 467                           char **data, unsigned int *data_len)
 468 {
 469         unsigned int total_data=0;
 470         unsigned int total_param=0;
 471         unsigned int this_data,this_param;
 472         uint8 eclass;
 473         uint32 ecode;
 474         char *tdata;
 475         char *tparam;
 476
 477         *data_len = *param_len = 0;
 478
 479         if (!cli_receive_smb(cli)) {
 480                 cli_signing_trans_stop(cli);
 481                 return False;
 482         }
 483
 484         show_msg(cli->inbuf);
 485
 486         /* sanity check */
 487         if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 488                 DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 489                          CVAL(cli->inbuf,smb_com)));
 490                 cli_signing_trans_stop(cli);
 491                 return(False);
 492         }
 493
 494         /*
 495          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 496          * to a trans call. This is not an error and should not
 497          * be treated as such.
 498          */
 499         if (cli_is_dos_error(cli)) {
 500                 cli_dos_error(cli, &eclass, &ecode);
 501                 if (cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata)) {
 502                         cli_signing_trans_stop(cli);
 503                         return(False);
 504                 }
 505         }
 506
 507         /*
 508          * Likewise for NT_STATUS_BUFFER_TOO_SMALL
 509          */
 510         if (cli_is_nt_error(cli)) {
 511                 if (!NT_STATUS_EQUAL(cli_nt_error(cli),
 512                                      NT_STATUS_BUFFER_TOO_SMALL)) {
 513                         cli_signing_trans_stop(cli);
 514                         return(False);
 515                 }
 516         }
 517
 518         /* parse out the lengths */
 519         total_data = SVAL(cli->inbuf,smb_ntr_TotalDataCount);
 520         total_param = SVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 521
 522         /* allocate it */
 523         if (total_data) {
 524                 tdata = Realloc(*data,total_data);
 525                 if (!tdata) {
 526                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge data buffer to %d\n",total_data));
 527                         cli_signing_trans_stop(cli);
 528                         return False;
 529                 } else {
 530                         *data = tdata;
 531                 }
 532         }
 533
 534         if (total_param) {
 535                 tparam = Realloc(*param,total_param);
 536                 if (!tparam) {
 537                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge param buffer to %d\n", total_param));
 538                         cli_signing_trans_stop(cli);
 539                         return False;
 540                 } else {
 541                         *param = tparam;
 542                 }
 543         }
 544
 545         while (1)  {
 546                 this_data = SVAL(cli->inbuf,smb_ntr_DataCount);
 547                 this_param = SVAL(cli->inbuf,smb_ntr_ParameterCount);
 548
 549                 if (this_data + *data_len > total_data ||
 550                     this_param + *param_len > total_param) {
 551                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 552                         cli_signing_trans_stop(cli);
 553                         return False;
 554                 }
 555
 556                 if (this_data + *data_len < this_data ||
 557                                 this_data + *data_len < *data_len ||
 558                                 this_param + *param_len < this_param ||
 559                                 this_param + *param_len < *param_len) {
 560                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 561                         cli_signing_trans_stop(cli);
 562                         return False;
 563                 }
 564
 565                 if (this_data) {
 566                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_ntr_DataDisplacement);
 567                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_ntr_DataOffset);
 568
 569                         if (data_offset_out > total_data ||
 570                                         data_offset_out + this_data > total_data ||
 571                                         data_offset_out + this_data < data_offset_out ||
 572                                         data_offset_out + this_data < this_data) {
 573                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 574                                 cli_signing_trans_stop(cli);
 575                                 return False;
 576                         }
 577                         if (data_offset_in > cli->bufsize ||
 578                                         data_offset_in + this_data >  cli->bufsize ||
 579                                         data_offset_in + this_data < data_offset_in ||
 580                                         data_offset_in + this_data < this_data) {
 581                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 582                                 cli_signing_trans_stop(cli);
 583                                 return False;
 584                         }
 585
 586                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 587                 }
 588
 589                 if (this_param) {
 590                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_ntr_ParameterDisplacement);
 591                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_ntr_ParameterOffset);
 592
 593                         if (param_offset_out > total_param ||
 594                                         param_offset_out + this_param > total_param ||
 595                                         param_offset_out + this_param < param_offset_out ||
 596                                         param_offset_out + this_param < this_param) {
 597                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 598                                 cli_signing_trans_stop(cli);
 599                                 return False;
 600                         }
 601                         if (param_offset_in > cli->bufsize ||
 602                                         param_offset_in + this_param >  cli->bufsize ||
 603                                         param_offset_in + this_param < param_offset_in ||
 604                                         param_offset_in + this_param < this_param) {
 605                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 606                                 cli_signing_trans_stop(cli);
 607                                 return False;
 608                         }
 609
 610                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 611                 }
 612
 613                 *data_len += this_data;
 614                 *param_len += this_param;
 615
 616                 if (total_data <= *data_len && total_param <= *param_len)
 617                         break;
 618
 619                 if (!cli_receive_smb(cli)) {
 620                         cli_signing_trans_stop(cli);
 621                         return False;
 622                 }
 623
 624                 show_msg(cli->inbuf);
 625
 626                 /* sanity check */
 627                 if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 628                         DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 629                                  CVAL(cli->inbuf,smb_com)));
 630                         cli_signing_trans_stop(cli);
 631                         return(False);
 632                 }
 633                 if (cli_is_dos_error(cli)) {
 634                         cli_dos_error(cli, &eclass, &ecode);
 635                         if(cli->nt_pipe_fnum == 0 || !(eclass == ERRDOS && ecode == ERRmoredata)) {
 636                                 cli_signing_trans_stop(cli);
 637                                 return(False);
 638                         }
 639                 }
 640                 /* parse out the total lengths again - they can shrink! */
 641                 if (SVAL(cli->inbuf,smb_ntr_TotalDataCount) < total_data)
 642                         total_data = SVAL(cli->inbuf,smb_ntr_TotalDataCount);
 643                 if (SVAL(cli->inbuf,smb_ntr_TotalParameterCount) < total_param)
 644                         total_param = SVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 645
 646                 if (total_data <= *data_len && total_param <= *param_len)
 647                         break;
 648         }
 649
 650         cli_signing_trans_stop(cli);
 651         return(True);
 652 }