libcli/smb: smb1cli_inbuf_parse_chain() and smb1cli_conn_dispatch_incoming() should...

They have to cope with large READX call replies that have
a length greater than smb_len_nbt() can handle.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
index cd995e9f8564841aba501ce3bde1353ee49f94fc..5a5828acc76c02c35df21a26fc425751b95da538 100644 (file)
--- a/libcli/smb/smbXcli_base.c
+++ b/libcli/smb/smbXcli_base.c
@@ -1618,7 +1618,7 @@ static NTSTATUS smb1cli_inbuf_parse_chain(uint8_t *buf, TALLOC_CTX *mem_ctx,
        NTSTATUS status;
        size_t min_size = MIN_SMB_SIZE;
 
-       buflen = smb_len_nbt(buf);
+       buflen = smb_len_tcp(buf);
        taken = 0;
 
        hdr = buf + NBT_HDR_SIZE;
@@ -1845,7 +1845,7 @@ static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
        uint16_t mid;
        bool oplock_break;
        uint8_t *inhdr = inbuf + NBT_HDR_SIZE;
-       size_t len = smb_len_nbt(inbuf);
+       size_t len = smb_len_tcp(inbuf);
        struct iovec *iov = NULL;
        int num_iov = 0;
        struct tevent_req **chain = NULL;