source/libsmb/clitrans.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client transaction calls
   4    Copyright (C) Andrew Tridgell 1994-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 */
  20
  21 #include "includes.h"
  22
  23
  24 /****************************************************************************
  25  Send a SMB trans or trans2 request.
  26 ****************************************************************************/
  27
  28 BOOL cli_send_trans(struct cli_state *cli, int trans,
  29                     const char *pipe_name,
  30                     int fid, int flags,
  31                     uint16 *setup, unsigned int lsetup, unsigned int msetup,
  32                     const char *param, unsigned int lparam, unsigned int mparam,
  33                     const char *data, unsigned int ldata, unsigned int mdata)
  34 {
  35         unsigned int i;
  36         unsigned int this_ldata,this_lparam;
  37         unsigned int tot_data=0,tot_param=0;
  38         char *outdata,*outparam;
  39         char *p;
  40         int pipe_name_len=0;
  41         uint16 mid;
  42
  43         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
  44         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
  45
  46         memset(cli->outbuf,'\0',smb_size);
  47         set_message(NULL,cli->outbuf,14+lsetup,0,True);
  48         SCVAL(cli->outbuf,smb_com,trans);
  49         SSVAL(cli->outbuf,smb_tid, cli->cnum);
  50         cli_setup_packet(cli);
  51
  52         /*
  53          * Save the mid we're using. We need this for finding
  54          * signing replies.
  55          */
  56
  57         mid = cli->mid;
  58
  59         if (pipe_name) {
  60                 pipe_name_len = clistr_push(cli, smb_buf(cli->outbuf), pipe_name, -1, STR_TERMINATE);
  61         }
  62
  63         outparam = smb_buf(cli->outbuf)+(trans==SMBtrans ? pipe_name_len : 3);
  64         outdata = outparam+this_lparam;
  65
  66         /* primary request */
  67         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
  68         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
  69         SSVAL(cli->outbuf,smb_mprcnt,mparam);   /* mprcnt */
  70         SSVAL(cli->outbuf,smb_mdrcnt,mdata);    /* mdrcnt */
  71         SCVAL(cli->outbuf,smb_msrcnt,msetup);   /* msrcnt */
  72         SSVAL(cli->outbuf,smb_flags,flags);     /* flags */
  73         SIVAL(cli->outbuf,smb_timeout,0);               /* timeout */
  74         SSVAL(cli->outbuf,smb_pscnt,this_lparam);       /* pscnt */
  75         SSVAL(cli->outbuf,smb_psoff,smb_offset(outparam,cli->outbuf)); /* psoff */
  76         SSVAL(cli->outbuf,smb_dscnt,this_ldata);        /* dscnt */
  77         SSVAL(cli->outbuf,smb_dsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
  78         SCVAL(cli->outbuf,smb_suwcnt,lsetup);   /* suwcnt */
  79         for (i=0;i<lsetup;i++)          /* setup[] */
  80                 SSVAL(cli->outbuf,smb_setup+i*2,setup[i]);
  81         p = smb_buf(cli->outbuf);
  82         if (trans != SMBtrans) {
  83                 *p++ = 0;  /* put in a null smb_name */
  84                 *p++ = 'D'; *p++ = ' '; /* observed in OS/2 */
  85         }
  86         if (this_lparam)                        /* param[] */
  87                 memcpy(outparam,param,this_lparam);
  88         if (this_ldata)                 /* data[] */
  89                 memcpy(outdata,data,this_ldata);
  90         cli_setup_bcc(cli, outdata+this_ldata);
  91
  92         show_msg(cli->outbuf);
  93
  94         if (!cli_send_smb(cli)) {
  95                 return False;
  96         }
  97
  98         /* Note we're in a trans state. Save the sequence
  99          * numbers for replies. */
 100         client_set_trans_sign_state_on(cli, mid);
 101
 102         if (this_ldata < ldata || this_lparam < lparam) {
 103                 /* receive interim response */
 104                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
 105                         client_set_trans_sign_state_off(cli, mid);
 106                         return(False);
 107                 }
 108
 109                 tot_data = this_ldata;
 110                 tot_param = this_lparam;
 111
 112                 while (tot_data < ldata || tot_param < lparam)  {
 113                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 114                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 115
 116                         set_message(NULL,cli->outbuf,trans==SMBtrans?8:9,0,True);
 117                         SCVAL(cli->outbuf,smb_com,(trans==SMBtrans ? SMBtranss : SMBtranss2));
 118
 119                         outparam = smb_buf(cli->outbuf);
 120                         outdata = outparam+this_lparam;
 121
 122                         /* secondary request */
 123                         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
 124                         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
 125                         SSVAL(cli->outbuf,smb_spscnt,this_lparam);      /* pscnt */
 126                         SSVAL(cli->outbuf,smb_spsoff,smb_offset(outparam,cli->outbuf)); /* psoff */
 127                         SSVAL(cli->outbuf,smb_spsdisp,tot_param);       /* psdisp */
 128                         SSVAL(cli->outbuf,smb_sdscnt,this_ldata);       /* dscnt */
 129                         SSVAL(cli->outbuf,smb_sdsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
 130                         SSVAL(cli->outbuf,smb_sdsdisp,tot_data);        /* dsdisp */
 131                         if (trans==SMBtrans2)
 132                                 SSVALS(cli->outbuf,smb_sfid,fid);               /* fid */
 133                         if (this_lparam)                        /* param[] */
 134                                 memcpy(outparam,param+tot_param,this_lparam);
 135                         if (this_ldata)                 /* data[] */
 136                                 memcpy(outdata,data+tot_data,this_ldata);
 137                         cli_setup_bcc(cli, outdata+this_ldata);
 138
 139                         /*
 140                          * Save the mid we're using. We need this for finding
 141                          * signing replies.
 142                          */
 143                         mid = cli->mid;
 144
 145                         show_msg(cli->outbuf);
 146                         if (!cli_send_smb(cli)) {
 147                                 client_set_trans_sign_state_off(cli, mid);
 148                                 return False;
 149                         }
 150
 151                         /* Ensure we use the same mid for the secondaries. */
 152                         cli->mid = mid;
 153
 154                         tot_data += this_ldata;
 155                         tot_param += this_lparam;
 156                 }
 157         }
 158
 159         return(True);
 160 }
 161
 162 /****************************************************************************
 163  Receive a SMB trans or trans2 response allocating the necessary memory.
 164 ****************************************************************************/
 165
 166 BOOL cli_receive_trans(struct cli_state *cli,int trans,
 167                               char **param, unsigned int *param_len,
 168                               char **data, unsigned int *data_len)
 169 {
 170         unsigned int total_data=0;
 171         unsigned int total_param=0;
 172         unsigned int this_data,this_param;
 173         NTSTATUS status;
 174         BOOL ret = False;
 175
 176         *data_len = *param_len = 0;
 177
 178         if (!cli_receive_smb(cli)) {
 179                 return False;
 180         }
 181
 182         show_msg(cli->inbuf);
 183
 184         /* sanity check */
 185         if (CVAL(cli->inbuf,smb_com) != trans) {
 186                 DEBUG(0,("Expected %s response, got command 0x%02x\n",
 187                          trans==SMBtrans?"SMBtrans":"SMBtrans2",
 188                          CVAL(cli->inbuf,smb_com)));
 189                 return False;
 190         }
 191
 192         /*
 193          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 194          * to a trans call. This is not an error and should not
 195          * be treated as such. Note that STATUS_NO_MORE_FILES is
 196          * returned when a trans2 findfirst/next finishes.
 197          * When setting up an encrypted transport we can also
 198          * see NT_STATUS_MORE_PROCESSING_REQUIRED here.
 199          *
 200          * Vista returns NT_STATUS_INACCESSIBLE_SYSTEM_SHORTCUT if the folder
 201          * "<share>/Users/All Users" is enumerated.  This is a special pseudo
 202          * folder, and the response does not have parameters (nor a parameter
 203          * length).
 204          */
 205         status = cli_nt_error(cli);
 206
 207         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 208                 if (NT_STATUS_IS_ERR(status) ||
 209                     NT_STATUS_EQUAL(status,STATUS_NO_MORE_FILES) ||
 210                     NT_STATUS_EQUAL(status,NT_STATUS_INACCESSIBLE_SYSTEM_SHORTCUT)) {
 211                         goto out;
 212                 }
 213         }
 214
 215         /* parse out the lengths */
 216         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 217         total_param = SVAL(cli->inbuf,smb_tprcnt);
 218
 219         /* allocate it */
 220         if (total_data!=0) {
 221                 *data = (char *)SMB_REALLOC(*data,total_data);
 222                 if (!(*data)) {
 223                         DEBUG(0,("cli_receive_trans: failed to enlarge data buffer\n"));
 224                         goto out;
 225                 }
 226         }
 227
 228         if (total_param!=0) {
 229                 *param = (char *)SMB_REALLOC(*param,total_param);
 230                 if (!(*param)) {
 231                         DEBUG(0,("cli_receive_trans: failed to enlarge param buffer\n"));
 232                         goto out;
 233                 }
 234         }
 235
 236         for (;;)  {
 237                 this_data = SVAL(cli->inbuf,smb_drcnt);
 238                 this_param = SVAL(cli->inbuf,smb_prcnt);
 239
 240                 if (this_data + *data_len > total_data ||
 241                     this_param + *param_len > total_param) {
 242                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 243                         goto out;
 244                 }
 245
 246                 if (this_data + *data_len < this_data ||
 247                                 this_data + *data_len < *data_len ||
 248                                 this_param + *param_len < this_param ||
 249                                 this_param + *param_len < *param_len) {
 250                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 251                         goto out;
 252                 }
 253
 254                 if (this_data) {
 255                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_drdisp);
 256                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_droff);
 257
 258                         if (data_offset_out > total_data ||
 259                                         data_offset_out + this_data > total_data ||
 260                                         data_offset_out + this_data < data_offset_out ||
 261                                         data_offset_out + this_data < this_data) {
 262                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 263                                 goto out;
 264                         }
 265                         if (data_offset_in > cli->bufsize ||
 266                                         data_offset_in + this_data >  cli->bufsize ||
 267                                         data_offset_in + this_data < data_offset_in ||
 268                                         data_offset_in + this_data < this_data) {
 269                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 270                                 goto out;
 271                         }
 272
 273                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 274                 }
 275                 if (this_param) {
 276                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_prdisp);
 277                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_proff);
 278
 279                         if (param_offset_out > total_param ||
 280                                         param_offset_out + this_param > total_param ||
 281                                         param_offset_out + this_param < param_offset_out ||
 282                                         param_offset_out + this_param < this_param) {
 283                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 284                                 goto out;
 285                         }
 286                         if (param_offset_in > cli->bufsize ||
 287                                         param_offset_in + this_param >  cli->bufsize ||
 288                                         param_offset_in + this_param < param_offset_in ||
 289                                         param_offset_in + this_param < this_param) {
 290                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 291                                 goto out;
 292                         }
 293
 294                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 295                 }
 296                 *data_len += this_data;
 297                 *param_len += this_param;
 298
 299                 if (total_data <= *data_len && total_param <= *param_len) {
 300                         ret = True;
 301                         break;
 302                 }
 303
 304                 if (!cli_receive_smb(cli)) {
 305                         goto out;
 306                 }
 307
 308                 show_msg(cli->inbuf);
 309
 310                 /* sanity check */
 311                 if (CVAL(cli->inbuf,smb_com) != trans) {
 312                         DEBUG(0,("Expected %s response, got command 0x%02x\n",
 313                                  trans==SMBtrans?"SMBtrans":"SMBtrans2",
 314                                  CVAL(cli->inbuf,smb_com)));
 315                         goto out;
 316                 }
 317                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 318                         if (NT_STATUS_IS_ERR(cli_nt_error(cli))) {
 319                                 goto out;
 320                         }
 321                 }
 322
 323                 /* parse out the total lengths again - they can shrink! */
 324                 if (SVAL(cli->inbuf,smb_tdrcnt) < total_data)
 325                         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 326                 if (SVAL(cli->inbuf,smb_tprcnt) < total_param)
 327                         total_param = SVAL(cli->inbuf,smb_tprcnt);
 328
 329                 if (total_data <= *data_len && total_param <= *param_len) {
 330                         ret = True;
 331                         break;
 332                 }
 333         }
 334
 335   out:
 336
 337         client_set_trans_sign_state_off(cli, SVAL(cli->inbuf,smb_mid));
 338         return ret;
 339 }
 340
 341 /****************************************************************************
 342  Send a SMB nttrans request.
 343 ****************************************************************************/
 344
 345 BOOL cli_send_nt_trans(struct cli_state *cli,
 346                        int function,
 347                        int flags,
 348                        uint16 *setup, unsigned int lsetup, unsigned int msetup,
 349                        char *param, unsigned int lparam, unsigned int mparam,
 350                        char *data, unsigned int ldata, unsigned int mdata)
 351 {
 352         unsigned int i;
 353         unsigned int this_ldata,this_lparam;
 354         unsigned int tot_data=0,tot_param=0;
 355         uint16 mid;
 356         char *outdata,*outparam;
 357
 358         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
 359         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
 360
 361         memset(cli->outbuf,'\0',smb_size);
 362         set_message(NULL,cli->outbuf,19+lsetup,0,True);
 363         SCVAL(cli->outbuf,smb_com,SMBnttrans);
 364         SSVAL(cli->outbuf,smb_tid, cli->cnum);
 365         cli_setup_packet(cli);
 366
 367         /*
 368          * Save the mid we're using. We need this for finding
 369          * signing replies.
 370          */
 371
 372         mid = cli->mid;
 373
 374         outparam = smb_buf(cli->outbuf)+3;
 375         outdata = outparam+this_lparam;
 376
 377         /* primary request */
 378         SCVAL(cli->outbuf,smb_nt_MaxSetupCount,msetup);
 379         SCVAL(cli->outbuf,smb_nt_Flags,flags);
 380         SIVAL(cli->outbuf,smb_nt_TotalParameterCount, lparam);
 381         SIVAL(cli->outbuf,smb_nt_TotalDataCount, ldata);
 382         SIVAL(cli->outbuf,smb_nt_MaxParameterCount, mparam);
 383         SIVAL(cli->outbuf,smb_nt_MaxDataCount, mdata);
 384         SIVAL(cli->outbuf,smb_nt_ParameterCount, this_lparam);
 385         SIVAL(cli->outbuf,smb_nt_ParameterOffset, smb_offset(outparam,cli->outbuf));
 386         SIVAL(cli->outbuf,smb_nt_DataCount, this_ldata);
 387         SIVAL(cli->outbuf,smb_nt_DataOffset, smb_offset(outdata,cli->outbuf));
 388         SIVAL(cli->outbuf,smb_nt_SetupCount, lsetup);
 389         SIVAL(cli->outbuf,smb_nt_Function, function);
 390         for (i=0;i<lsetup;i++)          /* setup[] */
 391                 SSVAL(cli->outbuf,smb_nt_SetupStart+i*2,setup[i]);
 392
 393         if (this_lparam)                        /* param[] */
 394                 memcpy(outparam,param,this_lparam);
 395         if (this_ldata)                 /* data[] */
 396                 memcpy(outdata,data,this_ldata);
 397
 398         cli_setup_bcc(cli, outdata+this_ldata);
 399
 400         show_msg(cli->outbuf);
 401         if (!cli_send_smb(cli)) {
 402                 return False;
 403         }
 404
 405         /* Note we're in a trans state. Save the sequence
 406          * numbers for replies. */
 407         client_set_trans_sign_state_on(cli, mid);
 408
 409         if (this_ldata < ldata || this_lparam < lparam) {
 410                 /* receive interim response */
 411                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
 412                         client_set_trans_sign_state_off(cli, mid);
 413                         return(False);
 414                 }
 415
 416                 tot_data = this_ldata;
 417                 tot_param = this_lparam;
 418
 419                 while (tot_data < ldata || tot_param < lparam)  {
 420                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 421                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 422
 423                         set_message(NULL,cli->outbuf,18,0,True);
 424                         SCVAL(cli->outbuf,smb_com,SMBnttranss);
 425
 426                         /* XXX - these should probably be aligned */
 427                         outparam = smb_buf(cli->outbuf);
 428                         outdata = outparam+this_lparam;
 429
 430                         /* secondary request */
 431                         SIVAL(cli->outbuf,smb_nts_TotalParameterCount,lparam);
 432                         SIVAL(cli->outbuf,smb_nts_TotalDataCount,ldata);
 433                         SIVAL(cli->outbuf,smb_nts_ParameterCount,this_lparam);
 434                         SIVAL(cli->outbuf,smb_nts_ParameterOffset,smb_offset(outparam,cli->outbuf));
 435                         SIVAL(cli->outbuf,smb_nts_ParameterDisplacement,tot_param);
 436                         SIVAL(cli->outbuf,smb_nts_DataCount,this_ldata);
 437                         SIVAL(cli->outbuf,smb_nts_DataOffset,smb_offset(outdata,cli->outbuf));
 438                         SIVAL(cli->outbuf,smb_nts_DataDisplacement,tot_data);
 439                         if (this_lparam)                        /* param[] */
 440                                 memcpy(outparam,param+tot_param,this_lparam);
 441                         if (this_ldata)                 /* data[] */
 442                                 memcpy(outdata,data+tot_data,this_ldata);
 443                         cli_setup_bcc(cli, outdata+this_ldata);
 444
 445                         /*
 446                          * Save the mid we're using. We need this for finding
 447                          * signing replies.
 448                          */
 449                         mid = cli->mid;
 450
 451                         show_msg(cli->outbuf);
 452
 453                         if (!cli_send_smb(cli)) {
 454                                 client_set_trans_sign_state_off(cli, mid);
 455                                 return False;
 456                         }
 457
 458                         /* Ensure we use the same mid for the secondaries. */
 459                         cli->mid = mid;
 460
 461                         tot_data += this_ldata;
 462                         tot_param += this_lparam;
 463                 }
 464         }
 465
 466         return(True);
 467 }
 468
 469 /****************************************************************************
 470  Receive a SMB nttrans response allocating the necessary memory.
 471 ****************************************************************************/
 472
 473 BOOL cli_receive_nt_trans(struct cli_state *cli,
 474                           char **param, unsigned int *param_len,
 475                           char **data, unsigned int *data_len)
 476 {
 477         unsigned int total_data=0;
 478         unsigned int total_param=0;
 479         unsigned int this_data,this_param;
 480         uint8 eclass;
 481         uint32 ecode;
 482         BOOL ret = False;
 483
 484         *data_len = *param_len = 0;
 485
 486         if (!cli_receive_smb(cli)) {
 487                 return False;
 488         }
 489
 490         show_msg(cli->inbuf);
 491
 492         /* sanity check */
 493         if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 494                 DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 495                          CVAL(cli->inbuf,smb_com)));
 496                 return(False);
 497         }
 498
 499         /*
 500          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 501          * to a trans call. This is not an error and should not
 502          * be treated as such.
 503          */
 504         if (cli_is_dos_error(cli)) {
 505                 cli_dos_error(cli, &eclass, &ecode);
 506                 if (!(eclass == ERRDOS && ecode == ERRmoredata)) {
 507                         goto out;
 508                 }
 509         }
 510
 511         /*
 512          * Likewise for NT_STATUS_BUFFER_TOO_SMALL
 513          */
 514         if (cli_is_nt_error(cli)) {
 515                 if (!NT_STATUS_EQUAL(cli_nt_error(cli),
 516                                      NT_STATUS_BUFFER_TOO_SMALL)) {
 517                         goto out;
 518                 }
 519         }
 520
 521         /* parse out the lengths */
 522         total_data = SVAL(cli->inbuf,smb_ntr_TotalDataCount);
 523         total_param = SVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 524
 525         /* allocate it */
 526         if (total_data) {
 527                 *data = (char *)SMB_REALLOC(*data,total_data);
 528                 if (!(*data)) {
 529                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge data buffer to %d\n",total_data));
 530                         goto out;
 531                 }
 532         }
 533
 534         if (total_param) {
 535                 *param = (char *)SMB_REALLOC(*param,total_param);
 536                 if (!(*param)) {
 537                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge param buffer to %d\n", total_param));
 538                         goto out;
 539                 }
 540         }
 541
 542         while (1)  {
 543                 this_data = SVAL(cli->inbuf,smb_ntr_DataCount);
 544                 this_param = SVAL(cli->inbuf,smb_ntr_ParameterCount);
 545
 546                 if (this_data + *data_len > total_data ||
 547                     this_param + *param_len > total_param) {
 548                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 549                         goto out;
 550                 }
 551
 552                 if (this_data + *data_len < this_data ||
 553                                 this_data + *data_len < *data_len ||
 554                                 this_param + *param_len < this_param ||
 555                                 this_param + *param_len < *param_len) {
 556                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 557                         goto out;
 558                 }
 559
 560                 if (this_data) {
 561                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_ntr_DataDisplacement);
 562                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_ntr_DataOffset);
 563
 564                         if (data_offset_out > total_data ||
 565                                         data_offset_out + this_data > total_data ||
 566                                         data_offset_out + this_data < data_offset_out ||
 567                                         data_offset_out + this_data < this_data) {
 568                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 569                                 goto out;
 570                         }
 571                         if (data_offset_in > cli->bufsize ||
 572                                         data_offset_in + this_data >  cli->bufsize ||
 573                                         data_offset_in + this_data < data_offset_in ||
 574                                         data_offset_in + this_data < this_data) {
 575                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 576                                 goto out;
 577                         }
 578
 579                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 580                 }
 581
 582                 if (this_param) {
 583                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_ntr_ParameterDisplacement);
 584                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_ntr_ParameterOffset);
 585
 586                         if (param_offset_out > total_param ||
 587                                         param_offset_out + this_param > total_param ||
 588                                         param_offset_out + this_param < param_offset_out ||
 589                                         param_offset_out + this_param < this_param) {
 590                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 591                                 goto out;
 592                         }
 593                         if (param_offset_in > cli->bufsize ||
 594                                         param_offset_in + this_param >  cli->bufsize ||
 595                                         param_offset_in + this_param < param_offset_in ||
 596                                         param_offset_in + this_param < this_param) {
 597                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 598                                 goto out;
 599                         }
 600
 601                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 602                 }
 603
 604                 *data_len += this_data;
 605                 *param_len += this_param;
 606
 607                 if (total_data <= *data_len && total_param <= *param_len) {
 608                         ret = True;
 609                         break;
 610                 }
 611
 612                 if (!cli_receive_smb(cli)) {
 613                         goto out;
 614                 }
 615
 616                 show_msg(cli->inbuf);
 617
 618                 /* sanity check */
 619                 if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 620                         DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 621                                  CVAL(cli->inbuf,smb_com)));
 622                         goto out;
 623                 }
 624                 if (cli_is_dos_error(cli)) {
 625                         cli_dos_error(cli, &eclass, &ecode);
 626                         if(!(eclass == ERRDOS && ecode == ERRmoredata)) {
 627                                 goto out;
 628                         }
 629                 }
 630                 /*
 631                  * Likewise for NT_STATUS_BUFFER_TOO_SMALL
 632                  */
 633                 if (cli_is_nt_error(cli)) {
 634                         if (!NT_STATUS_EQUAL(cli_nt_error(cli),
 635                                              NT_STATUS_BUFFER_TOO_SMALL)) {
 636                                 goto out;
 637                         }
 638                 }
 639
 640                 /* parse out the total lengths again - they can shrink! */
 641                 if (SVAL(cli->inbuf,smb_ntr_TotalDataCount) < total_data)
 642                         total_data = SVAL(cli->inbuf,smb_ntr_TotalDataCount);
 643                 if (SVAL(cli->inbuf,smb_ntr_TotalParameterCount) < total_param)
 644                         total_param = SVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 645
 646                 if (total_data <= *data_len && total_param <= *param_len) {
 647                         ret = True;
 648                         break;
 649                 }
 650         }
 651
 652   out:
 653
 654         client_set_trans_sign_state_off(cli, SVAL(cli->inbuf,smb_mid));
 655         return ret;
 656 }