s3:smbd: fix max_buffer handling of initial notify requests

[samba.git] / source3 / smbd / nttrans.c

diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 810f8b92b432b693357be196cad4f3584b068f90..8bb121a13515fe6c43a36cf9550485d642200e94 100644 (file)
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -543,6 +543,7 @@ void reply_ntcreate_and_X(struct smb_request *req)
                                fname,
                                ucf_flags,
                                NULL,
+                               NULL,
                                &smb_fname);
 
        TALLOC_FREE(case_state);
@@ -1115,6 +1116,7 @@ static void call_nt_transact_create(connection_struct *conn,
                                fname,
                                ucf_flags,
                                NULL,
+                               NULL,
                                &smb_fname);
 
        TALLOC_FREE(case_state);
@@ -1636,6 +1638,7 @@ void reply_ntrename(struct smb_request *req)
                                  oldname,
                                  ucf_flags_src,
                                  NULL,
+                                 NULL,
                                  &smb_fname_old);
        if (!NT_STATUS_IS_OK(status)) {
                if (NT_STATUS_EQUAL(status,
@@ -1652,6 +1655,7 @@ void reply_ntrename(struct smb_request *req)
        status = filename_convert(ctx, conn,
                                  newname,
                                  ucf_flags_dst,
+                                 NULL,
                                  &dest_has_wcard,
                                  &smb_fname_new);
        if (!NT_STATUS_IS_OK(status)) {
@@ -1802,8 +1806,10 @@ static void call_nt_transact_notify_change(connection_struct *conn,
 
        if (fsp->notify == NULL) {
 
-               status = change_notify_create(fsp, filter, recursive);
-
+               status = change_notify_create(fsp,
+                                             max_param_count,
+                                             filter,
+                                             recursive);
                if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(10, ("change_notify_create returned %s\n",
                                   nt_errstr(status)));
@@ -2317,6 +2323,7 @@ static enum ndr_err_code fill_qtlist_from_sids(TALLOC_CTX *mem_ctx,
        for (i = 0; i < elems; i++) {
                SMB_NTQUOTA_STRUCT qt;
                SMB_NTQUOTA_LIST *list_item;
+               bool ok;
 
                if (!NT_STATUS_IS_OK(vfs_get_ntquota(fsp,
                                                     SMB_USER_QUOTA_TYPE,
@@ -2333,7 +2340,15 @@ static enum ndr_err_code fill_qtlist_from_sids(TALLOC_CTX *mem_ctx,
                        return NDR_ERR_ALLOC;
                }
 
-               sid_to_uid(&sids[i], &list_item->uid);
+               ok = sid_to_uid(&sids[i], &list_item->uid);
+               if (!ok) {
+                       struct dom_sid_buf buf;
+                       DBG_WARNING("Could not convert SID %s to uid\n",
+                                   dom_sid_str_buf(&sids[i], &buf));
+                       /* No idea what to return here... */
+                       return NDR_ERR_INVALID_POINTER;
+               }
+
                list_item->quotas = talloc_zero(list_item, SMB_NTQUOTA_STRUCT);
                if (list_item->quotas == NULL) {
                        DBG_ERR("failed to allocate\n");
@@ -2450,7 +2465,7 @@ static enum ndr_err_code extract_sids_from_buf(TALLOC_CTX *mem_ctx,
                        }
                }
                *sids = talloc_zero_array(mem_ctx, struct dom_sid, i);
-               if (!sids) {
+               if (*sids == NULL) {
                        DBG_ERR("OOM\n");
                        err = NDR_ERR_ALLOC;
                        goto done;
@@ -2459,10 +2474,11 @@ static enum ndr_err_code extract_sids_from_buf(TALLOC_CTX *mem_ctx,
                *num = i;
 
                for (iter = sid_list, i = 0; iter; iter = iter->next, i++) {
+                       struct dom_sid_buf buf;
                        (*sids)[i] = iter->sid;
                        DBG_DEBUG("quota SID[%u] %s\n",
                                (unsigned int)i,
-                               sid_string_dbg(&iter->sid));
+                               dom_sid_str_buf(&iter->sid, &buf));
                }
        }
        err = NDR_ERR_SUCCESS;