tmp source4/torture/smb2/ioctl.c

diff --git a/source4/torture/smb2/ioctl.c b/source4/torture/smb2/ioctl.c
index eed81d1f5986b7fd243aaea504e0bed48dbfb4b0..60b261186265c70314e04f7e4d6a41f17327b1f5 100644 (file)
--- a/source4/torture/smb2/ioctl.c
+++ b/source4/torture/smb2/ioctl.c
@@ -849,6 +849,32 @@ static bool test_ioctl_copy_chunk_limits(struct torture_context *torture,
        torture_comment(torture, "limit max total bytes, got %u\n",
                        cc_rsp.total_bytes_written);
 
+       /* send huge chunk length request */
+       cc_copy.chunks[0].source_off = UINT64_MAX;
+       cc_copy.chunks[0].target_off = 0;
+       cc_copy.chunks[0].length = 1;
+
+       ndr_ret = ndr_push_struct_blob(&ioctl.smb2.in.out, tmp_ctx,
+                                      &cc_copy,
+                       (ndr_push_flags_fn_t)ndr_push_srv_copychunk_copy);
+       torture_assert_ndr_success(torture, ndr_ret, "marshalling request");
+
+       status = smb2_ioctl(tree, tmp_ctx, &ioctl.smb2);
+       torture_assert_ntstatus_equal(torture, status,
+                                     NT_STATUS_INVALID_PARAMETER,
+                                     "bad oversize chunk response");
+
+       ndr_ret = ndr_pull_struct_blob(&ioctl.smb2.out.out, tmp_ctx,
+                                      &cc_rsp,
+                       (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_rsp);
+       torture_assert_ndr_success(torture, ndr_ret, "unmarshalling response");
+
+       torture_comment(torture, "limit max chunks, got %u\n",
+                       cc_rsp.chunks_written);
+       torture_comment(torture, "limit max chunk len, got %u\n",
+                       cc_rsp.chunk_bytes_written);
+       torture_comment(torture, "limit max total bytes, got %u\n",
+                       cc_rsp.total_bytes_written);
        smb2_util_close(tree, src_h);
        smb2_util_close(tree, dest_h);
        talloc_free(tmp_ctx);