Author: metze Date: 2006-06-20 05:06:10 +0000 (Tue, 20 Jun 2006) New Revision: 16400
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=16400 Log: add more error checks metze Modified: branches/SAMBA_4_0/source/smb_server/smb/trans2.c Changeset: Modified: branches/SAMBA_4_0/source/smb_server/smb/trans2.c =================================================================== --- branches/SAMBA_4_0/source/smb_server/smb/trans2.c 2006-06-20 04:14:37 UTC (rev 16399) +++ branches/SAMBA_4_0/source/smb_server/smb/trans2.c 2006-06-20 05:06:10 UTC (rev 16400) @@ -117,11 +117,11 @@ const char **str, int flags) { + *str = NULL; /* we use STR_NO_RANGE_CHECK because the params are allocated separately in a DATA_BLOB, so we need to do our own range checking */ if (offset >= blob->length) { - *str = NULL; return 0; } @@ -456,7 +456,7 @@ TRANS2_CHECK_ASYNC_STATUS(io, union smb_open); - trans2_setup_reply(trans, 30, 0, 0); + TRANS2_CHECK(trans2_setup_reply(trans, 30, 0, 0)); smbsrv_push_fnum(trans->out.params.data, VWV(0), io->t2open.out.file.ntvfs); SSVAL(trans->out.params.data, VWV(1), io->t2open.out.attrib); @@ -481,7 +481,6 @@ { struct smb_trans2 *trans = op->trans; union smb_open *io; - NTSTATUS status; /* make sure we got enough parameters */ if (trans->in.params.length < 29) { @@ -505,9 +504,11 @@ io->t2open.in.eas = NULL; trans2_pull_blob_string(req, &trans->in.params, 28, &io->t2open.in.fname, 0); + if (io->t2open.in.fname == NULL) { + return NT_STATUS_FOOBAR; + } - status = ea_pull_list(&trans->in.data, io, &io->t2open.in.num_eas, &io->t2open.in.eas); - NT_STATUS_NOT_OK_RETURN(status); + TRANS2_CHECK(ea_pull_list(&trans->in.data, io, &io->t2open.in.num_eas, &io->t2open.in.eas)); op->op_info = io; op->send_fn = trans2_open_send; @@ -526,7 +527,7 @@ TRANS2_CHECK_ASYNC_STATUS_SIMPLE; - trans2_setup_reply(trans, 2, 0, 0); + TRANS2_CHECK(trans2_setup_reply(trans, 2, 0, 0)); SSVAL(trans->out.params.data, VWV(0), 0); @@ -540,7 +541,6 @@ { struct smb_trans2 *trans = op->trans; union smb_mkdir *io; - NTSTATUS status; /* make sure we got enough parameters */ if (trans->in.params.length < 5) { @@ -552,11 +552,13 @@ io->t2mkdir.level = RAW_MKDIR_T2MKDIR; trans2_pull_blob_string(req, &trans->in.params, 4, &io->t2mkdir.in.path, 0); + if (io->t2mkdir.in.path == NULL) { + return NT_STATUS_FOOBAR; + } - status = ea_pull_list(&trans->in.data, io, - &io->t2mkdir.in.num_eas, - &io->t2mkdir.in.eas); - NT_STATUS_NOT_OK_RETURN(status); + TRANS2_CHECK(ea_pull_list(&trans->in.data, io, + &io->t2mkdir.in.num_eas, + &io->t2mkdir.in.eas)); op->op_info = io; op->send_fn = trans2_simple_send; @@ -820,7 +822,6 @@ { struct smb_trans2 *trans = op->trans; union smb_fileinfo *st; - NTSTATUS status; uint16_t level; /* make sure we got enough parameters */ @@ -845,10 +846,9 @@ } if (st->generic.level == RAW_FILEINFO_EA_LIST) { - status = ea_pull_name_list(&trans->in.data, req, - &st->ea_list.in.num_names, - &st->ea_list.in.ea_names); - NT_STATUS_NOT_OK_RETURN(status); + TRANS2_CHECK(ea_pull_name_list(&trans->in.data, req, + &st->ea_list.in.num_names, + &st->ea_list.in.ea_names)); } op->op_info = st; @@ -865,7 +865,6 @@ { struct smb_trans2 *trans = op->trans; union smb_fileinfo *st; - NTSTATUS status; uint16_t level; struct ntvfs_handle *h; @@ -888,10 +887,9 @@ } if (st->generic.level == RAW_FILEINFO_EA_LIST) { - status = ea_pull_name_list(&trans->in.data, req, - &st->ea_list.in.num_names, - &st->ea_list.in.ea_names); - NT_STATUS_NOT_OK_RETURN(status); + TRANS2_CHECK(ea_pull_name_list(&trans->in.data, req, + &st->ea_list.in.num_names, + &st->ea_list.in.ea_names)); } op->op_info = st; @@ -910,6 +908,7 @@ const DATA_BLOB *blob) { uint32_t len; + DATA_BLOB str_blob; switch (st->generic.level) { case RAW_SFILEINFO_GENERIC: @@ -921,9 +920,11 @@ case RAW_SFILEINFO_STANDARD: CHECK_MIN_BLOB_SIZE(blob, 12); + st->standard.in.create_time = srv_pull_dos_date2(req->smb_conn, blob->data + 0); st->standard.in.access_time = srv_pull_dos_date2(req->smb_conn, blob->data + 4); st->standard.in.write_time = srv_pull_dos_date2(req->smb_conn, blob->data + 8); + return NT_STATUS_OK; case RAW_SFILEINFO_EA_SET: @@ -934,53 +935,68 @@ case SMB_SFILEINFO_BASIC_INFO: case SMB_SFILEINFO_BASIC_INFORMATION: CHECK_MIN_BLOB_SIZE(blob, 36); + st->basic_info.in.create_time = pull_nttime(blob->data, 0); st->basic_info.in.access_time = pull_nttime(blob->data, 8); st->basic_info.in.write_time = pull_nttime(blob->data, 16); st->basic_info.in.change_time = pull_nttime(blob->data, 24); st->basic_info.in.attrib = IVAL(blob->data, 32); + return NT_STATUS_OK; case SMB_SFILEINFO_DISPOSITION_INFO: case SMB_SFILEINFO_DISPOSITION_INFORMATION: CHECK_MIN_BLOB_SIZE(blob, 1); + st->disposition_info.in.delete_on_close = CVAL(blob->data, 0); + return NT_STATUS_OK; case SMB_SFILEINFO_ALLOCATION_INFO: case SMB_SFILEINFO_ALLOCATION_INFORMATION: CHECK_MIN_BLOB_SIZE(blob, 8); + st->allocation_info.in.alloc_size = BVAL(blob->data, 0); + return NT_STATUS_OK; case RAW_SFILEINFO_END_OF_FILE_INFO: case RAW_SFILEINFO_END_OF_FILE_INFORMATION: CHECK_MIN_BLOB_SIZE(blob, 8); + st->end_of_file_info.in.size = BVAL(blob->data, 0); + return NT_STATUS_OK; - case RAW_SFILEINFO_RENAME_INFORMATION: { - DATA_BLOB blob2; + case RAW_SFILEINFO_RENAME_INFORMATION: + CHECK_MIN_BLOB_SIZE(blob, 12); - CHECK_MIN_BLOB_SIZE(blob, 12); st->rename_information.in.overwrite = CVAL(blob->data, 0); st->rename_information.in.root_fid = IVAL(blob->data, 4); len = IVAL(blob->data, 8); - blob2.data = blob->data+12; - blob2.length = MIN(blob->length, len); - trans2_pull_blob_string(req, &blob2, 0, - &st->rename_information.in.new_name, STR_UNICODE); + str_blob.data = blob->data+12; + str_blob.length = MIN(blob->length, len); + trans2_pull_blob_string(req, &str_blob, 0, + &st->rename_information.in.new_name, + STR_UNICODE); + if (st->rename_information.in.new_name == NULL) { + return NT_STATUS_FOOBAR; + } + return NT_STATUS_OK; - } case RAW_SFILEINFO_POSITION_INFORMATION: CHECK_MIN_BLOB_SIZE(blob, 8); + st->position_information.in.position = BVAL(blob->data, 0); + return NT_STATUS_OK; case RAW_SFILEINFO_MODE_INFORMATION: CHECK_MIN_BLOB_SIZE(blob, 4); + st->mode_information.in.mode = IVAL(blob->data, 0); + return NT_STATUS_OK; case RAW_SFILEINFO_UNIX_BASIC: @@ -1005,7 +1021,6 @@ { struct smb_trans2 *trans = op->trans; union smb_setfileinfo *st; - NTSTATUS status; uint16_t level; struct ntvfs_handle *h; @@ -1027,8 +1042,7 @@ return NT_STATUS_INVALID_LEVEL; } - status = trans2_parse_sfileinfo(req, st, &trans->in.data); - NT_STATUS_NOT_OK_RETURN(status); + TRANS2_CHECK(trans2_parse_sfileinfo(req, st, &trans->in.data)); op->op_info = st; op->send_fn = trans2_simple_send; @@ -1044,7 +1058,6 @@ { struct smb_trans2 *trans = op->trans; union smb_setfileinfo *st; - NTSTATUS status; uint16_t level; /* make sure we got enough parameters */ @@ -1068,8 +1081,7 @@ return NT_STATUS_INVALID_LEVEL; } - status = trans2_parse_sfileinfo(req, st, &trans->in.data); - NT_STATUS_NOT_OK_RETURN(status); + TRANS2_CHECK(trans2_parse_sfileinfo(req, st, &trans->in.data)); op->op_info = st; op->send_fn = trans2_simple_send; @@ -1348,7 +1360,6 @@ { struct smb_trans2 *trans = op->trans; union smb_search_first *search; - NTSTATUS status; uint16_t level; struct find_state *state; @@ -1377,10 +1388,9 @@ } if (search->t2ffirst.level == RAW_SEARCH_EA_LIST) { - status = ea_pull_name_list(&trans->in.data, req, - &search->t2ffirst.in.num_names, - &search->t2ffirst.in.ea_names); - NT_STATUS_NOT_OK_RETURN(status); + TRANS2_CHECK(ea_pull_name_list(&trans->in.data, req, + &search->t2ffirst.in.num_names, + &search->t2ffirst.in.ea_names)); } /* setup the private state structure that the backend will @@ -1394,7 +1404,7 @@ state->flags = search->t2ffirst.in.flags; /* setup for just a header in the reply */ - trans2_setup_reply(trans, 10, 0, 0); + TRANS2_CHECK(trans2_setup_reply(trans, 10, 0, 0)); op->op_info = state; op->send_fn = trans2_findfirst_send; @@ -1435,7 +1445,6 @@ { struct smb_trans2 *trans = op->trans; union smb_search_next *search; - NTSTATUS status; uint16_t level; struct find_state *state; @@ -1464,10 +1473,9 @@ } if (search->t2fnext.level == RAW_SEARCH_EA_LIST) { - status = ea_pull_name_list(&trans->in.data, req, - &search->t2fnext.in.num_names, - &search->t2fnext.in.ea_names); - NT_STATUS_NOT_OK_RETURN(status); + TRANS2_CHECK(ea_pull_name_list(&trans->in.data, req, + &search->t2fnext.in.num_names, + &search->t2fnext.in.ea_names)); } /* setup the private state structure that the backend will give us in the callback */ @@ -1480,7 +1488,7 @@ state->flags = search->t2fnext.in.flags; /* setup for just a header in the reply */ - trans2_setup_reply(trans, 8, 0, 0); + TRANS2_CHECK(trans2_setup_reply(trans, 8, 0, 0)); op->op_info = state; op->send_fn = trans2_findnext_send;
