source/libsmb/clitrans.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client transaction calls
   4    Copyright (C) Andrew Tridgell 1994-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 */
  20
  21 #include "includes.h"
  22
  23
  24 /****************************************************************************
  25  Send a SMB trans or trans2 request.
  26 ****************************************************************************/
  27
  28 BOOL cli_send_trans(struct cli_state *cli, int trans,
  29                     const char *pipe_name,
  30                     int fid, int flags,
  31                     uint16 *setup, unsigned int lsetup, unsigned int msetup,
  32                     const char *param, unsigned int lparam, unsigned int mparam,
  33                     const char *data, unsigned int ldata, unsigned int mdata)
  34 {
  35         unsigned int i;
  36         unsigned int this_ldata,this_lparam;
  37         unsigned int tot_data=0,tot_param=0;
  38         char *outdata,*outparam;
  39         char *p;
  40         int pipe_name_len=0;
  41         uint16 mid;
  42
  43         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
  44         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
  45
  46         memset(cli->outbuf,'\0',smb_size);
  47         set_message(cli->outbuf,14+lsetup,0,True);
  48         SCVAL(cli->outbuf,smb_com,trans);
  49         SSVAL(cli->outbuf,smb_tid, cli->cnum);
  50         cli_setup_packet(cli);
  51
  52         /*
  53          * Save the mid we're using. We need this for finding
  54          * signing replies.
  55          */
  56
  57         mid = cli->mid;
  58
  59         if (pipe_name) {
  60                 pipe_name_len = clistr_push(cli, smb_buf(cli->outbuf), pipe_name, -1, STR_TERMINATE);
  61         }
  62
  63         outparam = smb_buf(cli->outbuf)+(trans==SMBtrans ? pipe_name_len : 3);
  64         outdata = outparam+this_lparam;
  65
  66         /* primary request */
  67         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
  68         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
  69         SSVAL(cli->outbuf,smb_mprcnt,mparam);   /* mprcnt */
  70         SSVAL(cli->outbuf,smb_mdrcnt,mdata);    /* mdrcnt */
  71         SCVAL(cli->outbuf,smb_msrcnt,msetup);   /* msrcnt */
  72         SSVAL(cli->outbuf,smb_flags,flags);     /* flags */
  73         SIVAL(cli->outbuf,smb_timeout,0);               /* timeout */
  74         SSVAL(cli->outbuf,smb_pscnt,this_lparam);       /* pscnt */
  75         SSVAL(cli->outbuf,smb_psoff,smb_offset(outparam,cli->outbuf)); /* psoff */
  76         SSVAL(cli->outbuf,smb_dscnt,this_ldata);        /* dscnt */
  77         SSVAL(cli->outbuf,smb_dsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
  78         SCVAL(cli->outbuf,smb_suwcnt,lsetup);   /* suwcnt */
  79         for (i=0;i<lsetup;i++)          /* setup[] */
  80                 SSVAL(cli->outbuf,smb_setup+i*2,setup[i]);
  81         p = smb_buf(cli->outbuf);
  82         if (trans != SMBtrans) {
  83                 *p++ = 0;  /* put in a null smb_name */
  84                 *p++ = 'D'; *p++ = ' '; /* observed in OS/2 */
  85         }
  86         if (this_lparam)                        /* param[] */
  87                 memcpy(outparam,param,this_lparam);
  88         if (this_ldata)                 /* data[] */
  89                 memcpy(outdata,data,this_ldata);
  90         cli_setup_bcc(cli, outdata+this_ldata);
  91
  92         show_msg(cli->outbuf);
  93
  94         if (!cli_send_smb(cli)) {
  95                 return False;
  96         }
  97
  98         if (this_ldata < ldata || this_lparam < lparam) {
  99                 /* receive interim response */
 100                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
 101                         return(False);
 102                 }
 103
 104                 tot_data = this_ldata;
 105                 tot_param = this_lparam;
 106
 107                 while (tot_data < ldata || tot_param < lparam)  {
 108                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 109                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 110
 111                         set_message(cli->outbuf,trans==SMBtrans?8:9,0,True);
 112                         SCVAL(cli->outbuf,smb_com,(trans==SMBtrans ? SMBtranss : SMBtranss2));
 113
 114                         outparam = smb_buf(cli->outbuf);
 115                         outdata = outparam+this_lparam;
 116
 117                         /* secondary request */
 118                         SSVAL(cli->outbuf,smb_tpscnt,lparam);   /* tpscnt */
 119                         SSVAL(cli->outbuf,smb_tdscnt,ldata);    /* tdscnt */
 120                         SSVAL(cli->outbuf,smb_spscnt,this_lparam);      /* pscnt */
 121                         SSVAL(cli->outbuf,smb_spsoff,smb_offset(outparam,cli->outbuf)); /* psoff */
 122                         SSVAL(cli->outbuf,smb_spsdisp,tot_param);       /* psdisp */
 123                         SSVAL(cli->outbuf,smb_sdscnt,this_ldata);       /* dscnt */
 124                         SSVAL(cli->outbuf,smb_sdsoff,smb_offset(outdata,cli->outbuf)); /* dsoff */
 125                         SSVAL(cli->outbuf,smb_sdsdisp,tot_data);        /* dsdisp */
 126                         if (trans==SMBtrans2)
 127                                 SSVALS(cli->outbuf,smb_sfid,fid);               /* fid */
 128                         if (this_lparam)                        /* param[] */
 129                                 memcpy(outparam,param+tot_param,this_lparam);
 130                         if (this_ldata)                 /* data[] */
 131                                 memcpy(outdata,data+tot_data,this_ldata);
 132                         cli_setup_bcc(cli, outdata+this_ldata);
 133
 134                         /*
 135                          * Save the mid we're using. We need this for finding
 136                          * signing replies.
 137                          */
 138                         mid = cli->mid;
 139
 140                         show_msg(cli->outbuf);
 141                         if (!cli_send_smb(cli)) {
 142                                 return False;
 143                         }
 144
 145                         /* Ensure we use the same mid for the secondaries. */
 146                         cli->mid = mid;
 147
 148                         tot_data += this_ldata;
 149                         tot_param += this_lparam;
 150                 }
 151         }
 152
 153         return(True);
 154 }
 155
 156 /****************************************************************************
 157  Receive a SMB trans or trans2 response allocating the necessary memory.
 158 ****************************************************************************/
 159
 160 BOOL cli_receive_trans(struct cli_state *cli,int trans,
 161                               char **param, unsigned int *param_len,
 162                               char **data, unsigned int *data_len)
 163 {
 164         unsigned int total_data=0;
 165         unsigned int total_param=0;
 166         unsigned int this_data,this_param;
 167         NTSTATUS status;
 168         BOOL ret = False;
 169
 170         *data_len = *param_len = 0;
 171
 172         if (!cli_receive_smb(cli)) {
 173                 return False;
 174         }
 175
 176         show_msg(cli->inbuf);
 177
 178         /* sanity check */
 179         if (CVAL(cli->inbuf,smb_com) != trans) {
 180                 DEBUG(0,("Expected %s response, got command 0x%02x\n",
 181                          trans==SMBtrans?"SMBtrans":"SMBtrans2",
 182                          CVAL(cli->inbuf,smb_com)));
 183                 return False;
 184         }
 185
 186         /*
 187          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 188          * to a trans call. This is not an error and should not
 189          * be treated as such. Note that STATUS_NO_MORE_FILES is
 190          * returned when a trans2 findfirst/next finishes.
 191          */
 192         status = cli_nt_error(cli);
 193
 194         if (NT_STATUS_IS_ERR(status) ||
 195             NT_STATUS_EQUAL(status,STATUS_NO_MORE_FILES) ||
 196             NT_STATUS_EQUAL(status,STATUS_INACCESSIBLE_SYSTEM_SHORTCUT)) {
 197                 goto out;
 198         }
 199
 200         /* parse out the lengths */
 201         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 202         total_param = SVAL(cli->inbuf,smb_tprcnt);
 203
 204         /* allocate it */
 205         if (total_data!=0) {
 206                 *data = (char *)SMB_REALLOC(*data,total_data);
 207                 if (!(*data)) {
 208                         DEBUG(0,("cli_receive_trans: failed to enlarge data buffer\n"));
 209                         goto out;
 210                 }
 211         }
 212
 213         if (total_param!=0) {
 214                 *param = (char *)SMB_REALLOC(*param,total_param);
 215                 if (!(*param)) {
 216                         DEBUG(0,("cli_receive_trans: failed to enlarge param buffer\n"));
 217                         goto out;
 218                 }
 219         }
 220
 221         for (;;)  {
 222                 this_data = SVAL(cli->inbuf,smb_drcnt);
 223                 this_param = SVAL(cli->inbuf,smb_prcnt);
 224
 225                 if (this_data + *data_len > total_data ||
 226                     this_param + *param_len > total_param) {
 227                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 228                         goto out;
 229                 }
 230
 231                 if (this_data + *data_len < this_data ||
 232                                 this_data + *data_len < *data_len ||
 233                                 this_param + *param_len < this_param ||
 234                                 this_param + *param_len < *param_len) {
 235                         DEBUG(1,("Data overflow in cli_receive_trans\n"));
 236                         goto out;
 237                 }
 238
 239                 if (this_data) {
 240                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_drdisp);
 241                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_droff);
 242
 243                         if (data_offset_out > total_data ||
 244                                         data_offset_out + this_data > total_data ||
 245                                         data_offset_out + this_data < data_offset_out ||
 246                                         data_offset_out + this_data < this_data) {
 247                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 248                                 goto out;
 249                         }
 250                         if (data_offset_in > cli->bufsize ||
 251                                         data_offset_in + this_data >  cli->bufsize ||
 252                                         data_offset_in + this_data < data_offset_in ||
 253                                         data_offset_in + this_data < this_data) {
 254                                 DEBUG(1,("Data overflow in cli_receive_trans\n"));
 255                                 goto out;
 256                         }
 257
 258                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 259                 }
 260                 if (this_param) {
 261                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_prdisp);
 262                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_proff);
 263
 264                         if (param_offset_out > total_param ||
 265                                         param_offset_out + this_param > total_param ||
 266                                         param_offset_out + this_param < param_offset_out ||
 267                                         param_offset_out + this_param < this_param) {
 268                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 269                                 goto out;
 270                         }
 271                         if (param_offset_in > cli->bufsize ||
 272                                         param_offset_in + this_param >  cli->bufsize ||
 273                                         param_offset_in + this_param < param_offset_in ||
 274                                         param_offset_in + this_param < this_param) {
 275                                 DEBUG(1,("Param overflow in cli_receive_trans\n"));
 276                                 goto out;
 277                         }
 278
 279                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 280                 }
 281                 *data_len += this_data;
 282                 *param_len += this_param;
 283
 284                 if (total_data <= *data_len && total_param <= *param_len) {
 285                         ret = True;
 286                         break;
 287                 }
 288
 289                 if (!cli_receive_smb(cli)) {
 290                         goto out;
 291                 }
 292
 293                 show_msg(cli->inbuf);
 294
 295                 /* sanity check */
 296                 if (CVAL(cli->inbuf,smb_com) != trans) {
 297                         DEBUG(0,("Expected %s response, got command 0x%02x\n",
 298                                  trans==SMBtrans?"SMBtrans":"SMBtrans2",
 299                                  CVAL(cli->inbuf,smb_com)));
 300                         goto out;
 301                 }
 302                 if (NT_STATUS_IS_ERR(cli_nt_error(cli))) {
 303                         goto out;
 304                 }
 305
 306                 /* parse out the total lengths again - they can shrink! */
 307                 if (SVAL(cli->inbuf,smb_tdrcnt) < total_data)
 308                         total_data = SVAL(cli->inbuf,smb_tdrcnt);
 309                 if (SVAL(cli->inbuf,smb_tprcnt) < total_param)
 310                         total_param = SVAL(cli->inbuf,smb_tprcnt);
 311
 312                 if (total_data <= *data_len && total_param <= *param_len) {
 313                         ret = True;
 314                         break;
 315                 }
 316         }
 317
 318   out:
 319
 320         return ret;
 321 }
 322
 323 /****************************************************************************
 324  Send a SMB nttrans request.
 325 ****************************************************************************/
 326
 327 BOOL cli_send_nt_trans(struct cli_state *cli,
 328                        int function,
 329                        int flags,
 330                        uint16 *setup, unsigned int lsetup, unsigned int msetup,
 331                        char *param, unsigned int lparam, unsigned int mparam,
 332                        char *data, unsigned int ldata, unsigned int mdata)
 333 {
 334         unsigned int i;
 335         unsigned int this_ldata,this_lparam;
 336         unsigned int tot_data=0,tot_param=0;
 337         uint16 mid;
 338         char *outdata,*outparam;
 339
 340         this_lparam = MIN(lparam,cli->max_xmit - (500+lsetup*2)); /* hack */
 341         this_ldata = MIN(ldata,cli->max_xmit - (500+lsetup*2+this_lparam));
 342
 343         memset(cli->outbuf,'\0',smb_size);
 344         set_message(cli->outbuf,19+lsetup,0,True);
 345         SCVAL(cli->outbuf,smb_com,SMBnttrans);
 346         SSVAL(cli->outbuf,smb_tid, cli->cnum);
 347         cli_setup_packet(cli);
 348
 349         /*
 350          * Save the mid we're using. We need this for finding
 351          * signing replies.
 352          */
 353
 354         mid = cli->mid;
 355
 356         outparam = smb_buf(cli->outbuf)+3;
 357         outdata = outparam+this_lparam;
 358
 359         /* primary request */
 360         SCVAL(cli->outbuf,smb_nt_MaxSetupCount,msetup);
 361         SCVAL(cli->outbuf,smb_nt_Flags,flags);
 362         SIVAL(cli->outbuf,smb_nt_TotalParameterCount, lparam);
 363         SIVAL(cli->outbuf,smb_nt_TotalDataCount, ldata);
 364         SIVAL(cli->outbuf,smb_nt_MaxParameterCount, mparam);
 365         SIVAL(cli->outbuf,smb_nt_MaxDataCount, mdata);
 366         SIVAL(cli->outbuf,smb_nt_ParameterCount, this_lparam);
 367         SIVAL(cli->outbuf,smb_nt_ParameterOffset, smb_offset(outparam,cli->outbuf));
 368         SIVAL(cli->outbuf,smb_nt_DataCount, this_ldata);
 369         SIVAL(cli->outbuf,smb_nt_DataOffset, smb_offset(outdata,cli->outbuf));
 370         SIVAL(cli->outbuf,smb_nt_SetupCount, lsetup);
 371         SIVAL(cli->outbuf,smb_nt_Function, function);
 372         for (i=0;i<lsetup;i++)          /* setup[] */
 373                 SSVAL(cli->outbuf,smb_nt_SetupStart+i*2,setup[i]);
 374
 375         if (this_lparam)                        /* param[] */
 376                 memcpy(outparam,param,this_lparam);
 377         if (this_ldata)                 /* data[] */
 378                 memcpy(outdata,data,this_ldata);
 379
 380         cli_setup_bcc(cli, outdata+this_ldata);
 381
 382         show_msg(cli->outbuf);
 383         if (!cli_send_smb(cli)) {
 384                 return False;
 385         }
 386
 387         if (this_ldata < ldata || this_lparam < lparam) {
 388                 /* receive interim response */
 389                 if (!cli_receive_smb(cli) || cli_is_error(cli)) {
 390                         return(False);
 391                 }
 392
 393                 tot_data = this_ldata;
 394                 tot_param = this_lparam;
 395
 396                 while (tot_data < ldata || tot_param < lparam)  {
 397                         this_lparam = MIN(lparam-tot_param,cli->max_xmit - 500); /* hack */
 398                         this_ldata = MIN(ldata-tot_data,cli->max_xmit - (500+this_lparam));
 399
 400                         set_message(cli->outbuf,18,0,True);
 401                         SCVAL(cli->outbuf,smb_com,SMBnttranss);
 402
 403                         /* XXX - these should probably be aligned */
 404                         outparam = smb_buf(cli->outbuf);
 405                         outdata = outparam+this_lparam;
 406
 407                         /* secondary request */
 408                         SIVAL(cli->outbuf,smb_nts_TotalParameterCount,lparam);
 409                         SIVAL(cli->outbuf,smb_nts_TotalDataCount,ldata);
 410                         SIVAL(cli->outbuf,smb_nts_ParameterCount,this_lparam);
 411                         SIVAL(cli->outbuf,smb_nts_ParameterOffset,smb_offset(outparam,cli->outbuf));
 412                         SIVAL(cli->outbuf,smb_nts_ParameterDisplacement,tot_param);
 413                         SIVAL(cli->outbuf,smb_nts_DataCount,this_ldata);
 414                         SIVAL(cli->outbuf,smb_nts_DataOffset,smb_offset(outdata,cli->outbuf));
 415                         SIVAL(cli->outbuf,smb_nts_DataDisplacement,tot_data);
 416                         if (this_lparam)                        /* param[] */
 417                                 memcpy(outparam,param+tot_param,this_lparam);
 418                         if (this_ldata)                 /* data[] */
 419                                 memcpy(outdata,data+tot_data,this_ldata);
 420                         cli_setup_bcc(cli, outdata+this_ldata);
 421
 422                         /*
 423                          * Save the mid we're using. We need this for finding
 424                          * signing replies.
 425                          */
 426                         mid = cli->mid;
 427
 428                         show_msg(cli->outbuf);
 429
 430                         if (!cli_send_smb(cli)) {
 431                                 return False;
 432                         }
 433
 434                         /* Ensure we use the same mid for the secondaries. */
 435                         cli->mid = mid;
 436
 437                         tot_data += this_ldata;
 438                         tot_param += this_lparam;
 439                 }
 440         }
 441
 442         return(True);
 443 }
 444
 445 /****************************************************************************
 446  Receive a SMB nttrans response allocating the necessary memory.
 447 ****************************************************************************/
 448
 449 BOOL cli_receive_nt_trans(struct cli_state *cli,
 450                           char **param, unsigned int *param_len,
 451                           char **data, unsigned int *data_len)
 452 {
 453         unsigned int total_data=0;
 454         unsigned int total_param=0;
 455         unsigned int this_data,this_param;
 456         uint8 eclass;
 457         uint32 ecode;
 458         BOOL ret = False;
 459
 460         *data_len = *param_len = 0;
 461
 462         if (!cli_receive_smb(cli)) {
 463                 return False;
 464         }
 465
 466         show_msg(cli->inbuf);
 467
 468         /* sanity check */
 469         if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 470                 DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 471                          CVAL(cli->inbuf,smb_com)));
 472                 return(False);
 473         }
 474
 475         /*
 476          * An NT RPC pipe call can return ERRDOS, ERRmoredata
 477          * to a trans call. This is not an error and should not
 478          * be treated as such.
 479          */
 480         if (cli_is_dos_error(cli)) {
 481                 cli_dos_error(cli, &eclass, &ecode);
 482                 if (!(eclass == ERRDOS && ecode == ERRmoredata)) {
 483                         goto out;
 484                 }
 485         }
 486
 487         /*
 488          * Likewise for NT_STATUS_BUFFER_TOO_SMALL
 489          */
 490         if (cli_is_nt_error(cli)) {
 491                 if (!NT_STATUS_EQUAL(cli_nt_error(cli),
 492                                      NT_STATUS_BUFFER_TOO_SMALL)) {
 493                         goto out;
 494                 }
 495         }
 496
 497         /* parse out the lengths */
 498         total_data = SVAL(cli->inbuf,smb_ntr_TotalDataCount);
 499         total_param = SVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 500
 501         /* allocate it */
 502         if (total_data) {
 503                 *data = (char *)SMB_REALLOC(*data,total_data);
 504                 if (!(*data)) {
 505                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge data buffer to %d\n",total_data));
 506                         goto out;
 507                 }
 508         }
 509
 510         if (total_param) {
 511                 *param = (char *)SMB_REALLOC(*param,total_param);
 512                 if (!(*param)) {
 513                         DEBUG(0,("cli_receive_nt_trans: failed to enlarge param buffer to %d\n", total_param));
 514                         goto out;
 515                 }
 516         }
 517
 518         while (1)  {
 519                 this_data = SVAL(cli->inbuf,smb_ntr_DataCount);
 520                 this_param = SVAL(cli->inbuf,smb_ntr_ParameterCount);
 521
 522                 if (this_data + *data_len > total_data ||
 523                     this_param + *param_len > total_param) {
 524                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 525                         goto out;
 526                 }
 527
 528                 if (this_data + *data_len < this_data ||
 529                                 this_data + *data_len < *data_len ||
 530                                 this_param + *param_len < this_param ||
 531                                 this_param + *param_len < *param_len) {
 532                         DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 533                         goto out;
 534                 }
 535
 536                 if (this_data) {
 537                         unsigned int data_offset_out = SVAL(cli->inbuf,smb_ntr_DataDisplacement);
 538                         unsigned int data_offset_in = SVAL(cli->inbuf,smb_ntr_DataOffset);
 539
 540                         if (data_offset_out > total_data ||
 541                                         data_offset_out + this_data > total_data ||
 542                                         data_offset_out + this_data < data_offset_out ||
 543                                         data_offset_out + this_data < this_data) {
 544                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 545                                 goto out;
 546                         }
 547                         if (data_offset_in > cli->bufsize ||
 548                                         data_offset_in + this_data >  cli->bufsize ||
 549                                         data_offset_in + this_data < data_offset_in ||
 550                                         data_offset_in + this_data < this_data) {
 551                                 DEBUG(1,("Data overflow in cli_receive_nt_trans\n"));
 552                                 goto out;
 553                         }
 554
 555                         memcpy(*data + data_offset_out, smb_base(cli->inbuf) + data_offset_in, this_data);
 556                 }
 557
 558                 if (this_param) {
 559                         unsigned int param_offset_out = SVAL(cli->inbuf,smb_ntr_ParameterDisplacement);
 560                         unsigned int param_offset_in = SVAL(cli->inbuf,smb_ntr_ParameterOffset);
 561
 562                         if (param_offset_out > total_param ||
 563                                         param_offset_out + this_param > total_param ||
 564                                         param_offset_out + this_param < param_offset_out ||
 565                                         param_offset_out + this_param < this_param) {
 566                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 567                                 goto out;
 568                         }
 569                         if (param_offset_in > cli->bufsize ||
 570                                         param_offset_in + this_param >  cli->bufsize ||
 571                                         param_offset_in + this_param < param_offset_in ||
 572                                         param_offset_in + this_param < this_param) {
 573                                 DEBUG(1,("Param overflow in cli_receive_nt_trans\n"));
 574                                 goto out;
 575                         }
 576
 577                         memcpy(*param + param_offset_out, smb_base(cli->inbuf) + param_offset_in, this_param);
 578                 }
 579
 580                 *data_len += this_data;
 581                 *param_len += this_param;
 582
 583                 if (total_data <= *data_len && total_param <= *param_len) {
 584                         ret = True;
 585                         break;
 586                 }
 587
 588                 if (!cli_receive_smb(cli)) {
 589                         goto out;
 590                 }
 591
 592                 show_msg(cli->inbuf);
 593
 594                 /* sanity check */
 595                 if (CVAL(cli->inbuf,smb_com) != SMBnttrans) {
 596                         DEBUG(0,("Expected SMBnttrans response, got command 0x%02x\n",
 597                                  CVAL(cli->inbuf,smb_com)));
 598                         goto out;
 599                 }
 600                 if (cli_is_dos_error(cli)) {
 601                         cli_dos_error(cli, &eclass, &ecode);
 602                         if(!(eclass == ERRDOS && ecode == ERRmoredata)) {
 603                                 goto out;
 604                         }
 605                 }
 606                 /*
 607                  * Likewise for NT_STATUS_BUFFER_TOO_SMALL
 608                  */
 609                 if (cli_is_nt_error(cli)) {
 610                         if (!NT_STATUS_EQUAL(cli_nt_error(cli),
 611                                              NT_STATUS_BUFFER_TOO_SMALL)) {
 612                                 goto out;
 613                         }
 614                 }
 615
 616                 /* parse out the total lengths again - they can shrink! */
 617                 if (SVAL(cli->inbuf,smb_ntr_TotalDataCount) < total_data)
 618                         total_data = SVAL(cli->inbuf,smb_ntr_TotalDataCount);
 619                 if (SVAL(cli->inbuf,smb_ntr_TotalParameterCount) < total_param)
 620                         total_param = SVAL(cli->inbuf,smb_ntr_TotalParameterCount);
 621
 622                 if (total_data <= *data_len && total_param <= *param_len) {
 623                         ret = True;
 624                         break;
 625                 }
 626         }
 627
 628   out:
 629
 630         return ret;
 631 }