The branch, master has been updated
       via  1c76e99 s3:smb2_server: s/i/idx in smbd_smb2_request_pending_queue()
       via  83d2620 s3:smb2_server: make use of SMBD_SMB2_OUT_HDR_PTR() in 
smbd_smb2_request_pending_queue()
       via  0067de2 s3:smb2_server: remove useless variable 'i'
       via  63d92a1 s3:smb2_server: rewrite dup_smb2_vec3() using 
SMBD_SMB2_*_IOV_OFS and helper variables
       via  fc8e3bd s3:smb2_server: make use of SMBD_SMB2_* macros in 
smbd_smb2_request_done_ex()
       via  97b5aaa s3:smb2_server: make use of SMBD_SMB2_* macros in 
smbd_smb2_request_verify_sizes()
       via  05ae95a s3:smb2_server: use the common buffer layout for 
smbd_smb2_request_pending*
       via  644eab3 s3:smb2_read: use SMBD_SMB2_NUM_IOV_PER_REQ when checking 
for sendfile() support
       via  2b9dd90 s3:smb2_read: fix indentation in 
schedule_smb2_sendfile_read()
       via  9f51d61 s3:smb2_server: don't try to update req->in.vector[0] in 
smbd_smb2_request_pending_queue()
      from  51dd39b selftest: Rename samba4.blackbox.pdbtest to 
samba.blackbox.pdbtest

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 1c76e99ae42f5ae0ca3f95832964739fb4e92584
Author: Stefan Metzmacher <[email protected]>
Date:   Wed Aug 8 09:15:17 2012 +0200

    s3:smb2_server: s/i/idx in smbd_smb2_request_pending_queue()
    
    metze
    
    Autobuild-User(master): Stefan Metzmacher <[email protected]>
    Autobuild-Date(master): Wed Aug  8 17:32:26 CEST 2012 on sn-devel-104

commit 83d262088bf6d826209ebad839059a7b2ebc45d0
Author: Stefan Metzmacher <[email protected]>
Date:   Wed Aug 8 09:13:17 2012 +0200

    s3:smb2_server: make use of SMBD_SMB2_OUT_HDR_PTR() in 
smbd_smb2_request_pending_queue()
    
    metze

commit 0067de20749d3cba7374ba494fd00a1ac71bbd95
Author: Stefan Metzmacher <[email protected]>
Date:   Wed Aug 8 09:12:31 2012 +0200

    s3:smb2_server: remove useless variable 'i'
    
    metze

commit 63d92a192d83878e114febf78b8d71b81b5f8f4f
Author: Stefan Metzmacher <[email protected]>
Date:   Wed Aug 8 08:32:40 2012 +0200

    s3:smb2_server: rewrite dup_smb2_vec3() using SMBD_SMB2_*_IOV_OFS and 
helper variables
    
    metze

commit fc8e3bd569c379f3fd20104f2dbd1c62c0f78c26
Author: Stefan Metzmacher <[email protected]>
Date:   Wed Aug 8 08:05:55 2012 +0200

    s3:smb2_server: make use of SMBD_SMB2_* macros in 
smbd_smb2_request_done_ex()
    
    metze

commit 97b5aaa6482b880840ed88e884a254c4da47768e
Author: Stefan Metzmacher <[email protected]>
Date:   Wed Aug 8 08:05:55 2012 +0200

    s3:smb2_server: make use of SMBD_SMB2_* macros in 
smbd_smb2_request_verify_sizes()
    
    metze

commit 05ae95a0d59e0cf5ef1eb92b244c1fd86589f19e
Author: Stefan Metzmacher <[email protected]>
Date:   Wed Aug 8 06:40:51 2012 +0200

    s3:smb2_server: use the common buffer layout for smbd_smb2_request_pending*
    
    metze

commit 644eab32af2ad9926e665642ffd212d0472b3d19
Author: Stefan Metzmacher <[email protected]>
Date:   Wed Aug 8 06:17:33 2012 +0200

    s3:smb2_read: use SMBD_SMB2_NUM_IOV_PER_REQ when checking for sendfile() 
support
    
    metze

commit 2b9dd9049e76b170e0c8fe5e2534770e8beacd28
Author: Stefan Metzmacher <[email protected]>
Date:   Wed Aug 8 06:16:35 2012 +0200

    s3:smb2_read: fix indentation in schedule_smb2_sendfile_read()
    
    metze

commit 9f51d610d2d14f2b0ac532019e42bd18b8a05d81
Author: Stefan Metzmacher <[email protected]>
Date:   Wed Aug 8 12:50:22 2012 +0200

    s3:smb2_server: don't try to update req->in.vector[0] in 
smbd_smb2_request_pending_queue()
    
    req->in.vector[0] is reserved for the transport and might be removed in 
future.
    This is currently always { NULL, 0 }, as it's not used, by our
    transport layer code. The SMB2 layer should never touch this!
    
    metze

-----------------------------------------------------------------------

Summary of changes:
 source3/smbd/smb2_read.c   |   16 ++--
 source3/smbd/smb2_server.c |  213 ++++++++++++++++++++++++-------------------
 2 files changed, 127 insertions(+), 102 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/smbd/smb2_read.c b/source3/smbd/smb2_read.c
index ba352f7..150bdb8 100644
--- a/source3/smbd/smb2_read.c
+++ b/source3/smbd/smb2_read.c
@@ -275,14 +275,14 @@ static NTSTATUS schedule_smb2_sendfile_read(struct 
smbd_smb2_request *smb2req,
        */
 
        if (!lp__use_sendfile(SNUM(fsp->conn)) ||
-                       smb2req->do_signing ||
-                       smb2req->in.vector_count != 4 ||
-                       (fsp->base_fsp != NULL) ||
-                       (fsp->wcp != NULL) ||
-                       (!S_ISREG(fsp->fsp_name->st.st_ex_mode)) ||
-                       (state->in_offset >= fsp->fsp_name->st.st_ex_size) ||
-                       (fsp->fsp_name->st.st_ex_size < state->in_offset +
-                               state->in_length)) {
+           smb2req->do_signing ||
+           smb2req->in.vector_count < (2*SMBD_SMB2_NUM_IOV_PER_REQ) ||
+           (fsp->base_fsp != NULL) ||
+           (fsp->wcp != NULL) ||
+           (!S_ISREG(fsp->fsp_name->st.st_ex_mode)) ||
+           (state->in_offset >= fsp->fsp_name->st.st_ex_size) ||
+           (fsp->fsp_name->st.st_ex_size < state->in_offset + 
state->in_length))
+       {
                return NT_STATUS_RETRY;
        }
 
diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
index 19a1051..5242547 100644
--- a/source3/smbd/smb2_server.c
+++ b/source3/smbd/smb2_server.c
@@ -934,68 +934,78 @@ static bool dup_smb2_vec3(TALLOC_CTX *ctx,
                        struct iovec *outvec,
                        const struct iovec *srcvec)
 {
-       /* vec[0] is always boilerplate and must
+       const uint8_t *srchdr;
+       size_t srchdr_len;
+       const uint8_t *srcbody;
+       size_t srcbody_len;
+       const uint8_t *expected_srcbody;
+       const uint8_t *srcdyn;
+       size_t srcdyn_len;
+       const uint8_t *expected_srcdyn;
+       uint8_t *dsthdr;
+       uint8_t *dstbody;
+       uint8_t *dstdyn;
+
+       srchdr  = (const uint8_t *)srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base;
+       srchdr_len = srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_len;
+       srcbody = (const uint8_t *)srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_base;
+       srcbody_len = srcvec[SMBD_SMB2_BODY_IOV_OFS].iov_len;
+       expected_srcbody = srchdr + SMB2_HDR_BODY;
+       srcdyn  = (const uint8_t *)srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_base;
+       srcdyn_len = srcvec[SMBD_SMB2_DYN_IOV_OFS].iov_len;
+       expected_srcdyn = srcbody + 8;
+
+       if (srchdr_len != SMB2_HDR_BODY) {
+               return false;
+       }
+
+       /* vec[SMBD_SMB2_HDR_IOV_OFS] is always boilerplate and must
         * be allocated with size OUTVEC_ALLOC_SIZE. */
 
-       outvec[0].iov_base = talloc_memdup(ctx,
-                               srcvec[0].iov_base,
-                               OUTVEC_ALLOC_SIZE);
-       if (!outvec[0].iov_base) {
+       dsthdr = talloc_memdup(ctx, srchdr, OUTVEC_ALLOC_SIZE);
+       if (dsthdr == NULL) {
                return false;
        }
-       outvec[0].iov_len = SMB2_HDR_BODY;
+       outvec[SMBD_SMB2_HDR_IOV_OFS].iov_base = (void *)dsthdr;
+       outvec[SMBD_SMB2_HDR_IOV_OFS].iov_len = SMB2_HDR_BODY;
 
        /*
-        * If this is a "standard" vec[1] of length 8,
-        * pointing to srcvec[0].iov_base + SMB2_HDR_BODY,
+        * If this is a "standard" vec[SMBD_SMB2_BOFY_IOV_OFS] of length 8,
+        * pointing to srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + SMB2_HDR_BODY,
         * then duplicate this. Else use talloc_memdup().
         */
 
-       if (srcvec[1].iov_len == 8 &&
-                       srcvec[1].iov_base ==
-                               ((uint8_t *)srcvec[0].iov_base) +
-                                       SMB2_HDR_BODY) {
-               outvec[1].iov_base = ((uint8_t *)outvec[0].iov_base) +
-                                       SMB2_HDR_BODY;
-               outvec[1].iov_len = 8;
+       if ((srcbody == expected_srcbody) && (srcbody_len == 8)) {
+               dstbody = dsthdr + SMB2_HDR_BODY;
        } else {
-               outvec[1].iov_base = talloc_memdup(ctx,
-                               srcvec[1].iov_base,
-                               srcvec[1].iov_len);
-               if (!outvec[1].iov_base) {
+               dstbody = talloc_memdup(ctx, srcbody, srcbody_len);
+               if (dstbody == NULL) {
                        return false;
                }
-               outvec[1].iov_len = srcvec[1].iov_len;
        }
+       outvec[SMBD_SMB2_BODY_IOV_OFS].iov_base = (void *)dstbody;
+       outvec[SMBD_SMB2_BODY_IOV_OFS].iov_len = srcbody_len;
 
        /*
-        * If this is a "standard" vec[2] of length 1,
-        * pointing to srcvec[0].iov_base + (OUTVEC_ALLOC_SIZE - 1)
+        * If this is a "standard" vec[SMBD_SMB2_DYN_IOV_OFS] of length 1,
+        * pointing to
+        * srcvec[SMBD_SMB2_HDR_IOV_OFS].iov_base + 8
         * then duplicate this. Else use talloc_memdup().
         */
 
-       if (srcvec[2].iov_base &&
-                       srcvec[2].iov_len) {
-               if (srcvec[2].iov_base ==
-                               ((uint8_t *)srcvec[0].iov_base) +
-                                       (OUTVEC_ALLOC_SIZE - 1) &&
-                               srcvec[2].iov_len == 1) {
-                       /* Common SMB2 error packet case. */
-                       outvec[2].iov_base = ((uint8_t *)outvec[0].iov_base) +
-                               (OUTVEC_ALLOC_SIZE - 1);
-               } else {
-                       outvec[2].iov_base = talloc_memdup(ctx,
-                                       srcvec[2].iov_base,
-                                       srcvec[2].iov_len);
-                       if (!outvec[2].iov_base) {
-                               return false;
-                       }
-               }
-               outvec[2].iov_len = srcvec[2].iov_len;
+       if ((srcdyn == expected_srcdyn) && (srcdyn_len == 1)) {
+               dstdyn = dsthdr + SMB2_HDR_BODY + 8;
+       } else if (srcdyn == NULL) {
+               dstdyn = NULL;
        } else {
-               outvec[2].iov_base = NULL;
-               outvec[2].iov_len = 0;
+               dstdyn = talloc_memdup(ctx, srcdyn, srcdyn_len);
+               if (dstdyn == NULL) {
+                       return false;
+               }
        }
+       outvec[SMBD_SMB2_DYN_IOV_OFS].iov_base = (void *)dstdyn;
+       outvec[SMBD_SMB2_DYN_IOV_OFS].iov_len = srcdyn_len;
+
        return true;
 }
 
@@ -1123,8 +1133,8 @@ static NTSTATUS smb2_send_async_interim_response(const 
struct smbd_smb2_request
 
 struct smbd_smb2_request_pending_state {
         struct smbd_server_connection *sconn;
-        uint8_t buf[4 + SMB2_HDR_BODY + 0x08 + 1];
-        struct iovec vector[3];
+        uint8_t buf[NBT_HDR_SIZE + SMB2_HDR_BODY + 0x08 + 1];
+        struct iovec vector[1 + SMBD_SMB2_NUM_IOV_PER_REQ];
 };
 
 static void smbd_smb2_request_pending_writev_done(struct tevent_req *subreq)
@@ -1157,7 +1167,7 @@ NTSTATUS smbd_smb2_request_pending_queue(struct 
smbd_smb2_request *req,
                                         uint32_t defer_time)
 {
        NTSTATUS status;
-       int i = req->current_idx;
+       int idx = req->current_idx;
        struct timeval defer_endtime;
        uint8_t *outhdr = NULL;
        uint32_t flags;
@@ -1174,14 +1184,14 @@ NTSTATUS smbd_smb2_request_pending_queue(struct 
smbd_smb2_request *req,
                return NT_STATUS_OK;
        }
 
-       outhdr = (uint8_t *)req->out.vector[i].iov_base;
+       outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
        flags = IVAL(outhdr, SMB2_HDR_FLAGS);
        if (flags & SMB2_HDR_FLAG_ASYNC) {
                /* We're already async. */
                return NT_STATUS_OK;
        }
 
-       if (req->in.vector_count > i + SMBD_SMB2_NUM_IOV_PER_REQ) {
+       if (req->in.vector_count > idx + SMBD_SMB2_NUM_IOV_PER_REQ) {
                /*
                 * We're trying to go async in a compound
                 * request chain. This is not allowed.
@@ -1228,16 +1238,13 @@ NTSTATUS smbd_smb2_request_pending_queue(struct 
smbd_smb2_request *req,
 
                /* Re-arrange the in.vectors. */
                memmove(&req->in.vector[req->current_idx],
-                       &req->in.vector[i],
+                       &req->in.vector[idx],
                        sizeof(req->in.vector[0])*SMBD_SMB2_NUM_IOV_PER_REQ);
                req->in.vector_count = req->current_idx + 
SMBD_SMB2_NUM_IOV_PER_REQ;
 
-               /* Reset the new in size. */
-               smb2_setup_nbt_length(req->in.vector, req->in.vector_count);
-
                /* Re-arrange the out.vectors. */
                memmove(&req->out.vector[req->current_idx],
-                       &req->out.vector[i],
+                       &req->out.vector[idx],
                        sizeof(req->out.vector[0])*SMBD_SMB2_NUM_IOV_PER_REQ);
                req->out.vector_count = req->current_idx + 
SMBD_SMB2_NUM_IOV_PER_REQ;
 
@@ -1272,6 +1279,7 @@ static void smbd_smb2_request_pending_timer(struct 
tevent_context *ev,
        const uint8_t *inhdr = NULL;
        uint8_t *hdr = NULL;
        uint8_t *body = NULL;
+       uint8_t *dyn = NULL;
        uint32_t flags = 0;
        uint64_t message_id = 0;
        uint64_t async_id = 0;
@@ -1309,19 +1317,13 @@ static void smbd_smb2_request_pending_timer(struct 
tevent_context *ev,
        }
        state->sconn = req->sconn;
 
-       state->vector[0].iov_base = (void *)state->buf;
-       state->vector[0].iov_len = 4;
 
-       state->vector[1].iov_base = state->buf + 4;
-       state->vector[1].iov_len = SMB2_HDR_BODY;
+       hdr = state->buf + NBT_HDR_SIZE;
+       body = hdr + SMB2_HDR_BODY;
+       dyn = body + 8;
 
-       state->vector[2].iov_base = state->buf + 4 + SMB2_HDR_BODY;
-       state->vector[2].iov_len = 9;
 
-       smb2_setup_nbt_length(state->vector, 3);
 
-       hdr = (uint8_t *)state->vector[1].iov_base;
-       body = (uint8_t *)state->vector[2].iov_base;
 
        SIVAL(hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
        SSVAL(hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
@@ -1344,14 +1346,28 @@ static void smbd_smb2_request_pending_timer(struct 
tevent_context *ev,
        SCVAL(body, 0x03, 0);
        SIVAL(body, 0x04, 0);
        /* Match W2K8R2... */
-       SCVAL(body, 0x08, 0x21);
+       SCVAL(dyn,  0x00, 0x21);
+
+       state->vector[0].iov_base = (void *)state->buf;
+       state->vector[0].iov_len = NBT_HDR_SIZE;
+
+       state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_base  = hdr;
+       state->vector[1+SMBD_SMB2_HDR_IOV_OFS].iov_len   = SMB2_HDR_BODY;
+
+       state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_base = body;
+       state->vector[1+SMBD_SMB2_BODY_IOV_OFS].iov_len  = 8;
+
+       state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_base  = dyn;
+       state->vector[1+SMBD_SMB2_DYN_IOV_OFS].iov_len   = 1;
+
+       smb2_setup_nbt_length(state->vector, 1 + SMBD_SMB2_NUM_IOV_PER_REQ);
 
        /* Ensure we correctly go through crediting. Grant
           the credits now, and zero credits on the final
           response. */
        smb2_set_operation_credit(req->sconn,
                        SMBD_SMB2_IN_HDR_IOV(req),
-                       &state->vector[1]);
+                       &state->vector[1+SMBD_SMB2_HDR_IOV_OFS]);
 
        SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
 
@@ -1362,8 +1378,9 @@ static void smbd_smb2_request_pending_timer(struct 
tevent_context *ev,
                DATA_BLOB signing_key = x->global->channels[0].signing_key;
 
                status = smb2_signing_sign_pdu(signing_key,
-                                              conn->protocol,
-                                              &state->vector[1], 2);
+                                       conn->protocol,
+                                       &state->vector[1+SMBD_SMB2_HDR_IOV_OFS],
+                                       SMBD_SMB2_NUM_IOV_PER_REQ);
                if (!NT_STATUS_IS_OK(status)) {
                        smbd_server_connection_terminate(req->sconn,
                                                nt_errstr(status));
@@ -1376,7 +1393,7 @@ static void smbd_smb2_request_pending_timer(struct 
tevent_context *ev,
                                        state->sconn->smb2.stream,
                                        state->sconn->smb2.send_queue,
                                        state->vector,
-                                       3);
+                                       ARRAY_SIZE(state->vector));
        if (subreq == NULL) {
                smbd_server_connection_terminate(state->sconn,
                                                 
nt_errstr(NT_STATUS_NO_MEMORY));
@@ -1602,27 +1619,33 @@ NTSTATUS smbd_smb2_request_verify_creditcharge(struct 
smbd_smb2_request *req,
 NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
                                        size_t expected_body_size)
 {
+       struct iovec *inhdr_v;
        const uint8_t *inhdr;
        uint16_t opcode;
        const uint8_t *inbody;
-       int i = req->current_idx;
        size_t body_size;
        size_t min_dyn_size = expected_body_size & 0x00000001;
+       int max_idx = req->in.vector_count - SMBD_SMB2_NUM_IOV_PER_REQ;
 
        /*
         * The following should be checked already.
         */
-       if ((i+2) > req->in.vector_count) {
+       if (req->in.vector_count < SMBD_SMB2_NUM_IOV_PER_REQ) {
+               return NT_STATUS_INTERNAL_ERROR;
+       }
+       if (req->current_idx > max_idx) {
                return NT_STATUS_INTERNAL_ERROR;
        }
-       if (req->in.vector[i+0].iov_len != SMB2_HDR_BODY) {
+
+       inhdr_v = SMBD_SMB2_IN_HDR_IOV(req);
+       if (inhdr_v->iov_len != SMB2_HDR_BODY) {
                return NT_STATUS_INTERNAL_ERROR;
        }
-       if (req->in.vector[i+1].iov_len < 2) {
+       if (SMBD_SMB2_IN_BODY_LEN(req) < 2) {
                return NT_STATUS_INTERNAL_ERROR;
        }
 
-       inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
+       inhdr = SMBD_SMB2_IN_HDR_PTR(req);
        opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
 
        switch (opcode) {
@@ -1637,14 +1660,14 @@ NTSTATUS smbd_smb2_request_verify_sizes(struct 
smbd_smb2_request *req,
         * where the last byte might be in the
         * dynamic section..
         */
-       if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
+       if (SMBD_SMB2_IN_BODY_LEN(req) != (expected_body_size & 0xFFFFFFFE)) {
                return NT_STATUS_INVALID_PARAMETER;
        }
-       if (req->in.vector[i+2].iov_len < min_dyn_size) {
+       if (SMBD_SMB2_IN_DYN_LEN(req) < min_dyn_size) {
                return NT_STATUS_INVALID_PARAMETER;
        }
 
-       inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
+       inbody = SMBD_SMB2_IN_BODY_PTR(req);
 
        body_size = SVAL(inbody, 0x00);
        if (body_size != expected_body_size) {
@@ -2166,12 +2189,13 @@ NTSTATUS smbd_smb2_request_done_ex(struct 
smbd_smb2_request *req,
                                   const char *location)
 {
        uint8_t *outhdr;
-       int i = req->current_idx;
+       struct iovec *outbody_v;
+       struct iovec *outdyn_v;
        uint32_t next_command_ofs;
 
        DEBUG(10,("smbd_smb2_request_done_ex: "
                  "idx[%d] status[%s] body[%u] dyn[%s:%u] at %s\n",
-                 i, nt_errstr(status), (unsigned int)body.length,
+                 req->current_idx, nt_errstr(status), (unsigned 
int)body.length,
                  dyn ? "yes": "no",
                  (unsigned int)(dyn ? dyn->length : 0),
                  location));
@@ -2184,32 +2208,34 @@ NTSTATUS smbd_smb2_request_done_ex(struct 
smbd_smb2_request *req,
                return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
        }
 
-       outhdr = (uint8_t *)req->out.vector[i].iov_base;
+       outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
+       outbody_v = SMBD_SMB2_OUT_BODY_IOV(req);
+       outdyn_v = SMBD_SMB2_OUT_DYN_IOV(req);
 
        next_command_ofs = IVAL(outhdr, SMB2_HDR_NEXT_COMMAND);
        SIVAL(outhdr, SMB2_HDR_STATUS, NT_STATUS_V(status));
 
-       req->out.vector[i+1].iov_base = (void *)body.data;
-       req->out.vector[i+1].iov_len = body.length;
+       outbody_v->iov_base = (void *)body.data;
+       outbody_v->iov_len = body.length;
 
        if (dyn) {
-               req->out.vector[i+2].iov_base   = (void *)dyn->data;
-               req->out.vector[i+2].iov_len    = dyn->length;
+               outdyn_v->iov_base = (void *)dyn->data;
+               outdyn_v->iov_len = dyn->length;
        } else {
-               req->out.vector[i+2].iov_base = NULL;
-               req->out.vector[i+2].iov_len = 0;
+               outdyn_v->iov_base = NULL;
+               outdyn_v->iov_len = 0;
        }
 
        /* see if we need to recalculate the offset to the next response */
        if (next_command_ofs > 0) {
                next_command_ofs  = SMB2_HDR_BODY;
-               next_command_ofs += req->out.vector[i+1].iov_len;
-               next_command_ofs += req->out.vector[i+2].iov_len;
+               next_command_ofs += SMBD_SMB2_OUT_BODY_LEN(req);
+               next_command_ofs += SMBD_SMB2_OUT_DYN_LEN(req);
        }
 
        if ((next_command_ofs % 8) != 0) {
                size_t pad_size = 8 - (next_command_ofs % 8);
-               if (req->out.vector[i+2].iov_len == 0) {
+               if (SMBD_SMB2_OUT_DYN_LEN(req) == 0) {
                        /*
                         * if the dyn buffer is empty
                         * we can use it to add padding
@@ -2223,8 +2249,8 @@ NTSTATUS smbd_smb2_request_done_ex(struct 
smbd_smb2_request *req,
                                                NT_STATUS_NO_MEMORY);
                        }
 
-                       req->out.vector[i+2].iov_base = (void *)pad;
-                       req->out.vector[i+2].iov_len = pad_size;
+                       outdyn_v->iov_base = (void *)pad;
+                       outdyn_v->iov_len = pad_size;
                } else {
                        /*
                         * For now we copy the dynamic buffer
@@ -2235,8 +2261,8 @@ NTSTATUS smbd_smb2_request_done_ex(struct 
smbd_smb2_request *req,
                        size_t new_size;
                        uint8_t *new_dyn;
 
-                       old_size = req->out.vector[i+2].iov_len;
-                       old_dyn = (uint8_t *)req->out.vector[i+2].iov_base;
+                       old_size = SMBD_SMB2_OUT_DYN_LEN(req);
+                       old_dyn = SMBD_SMB2_OUT_DYN_PTR(req);
 
                        new_size = old_size + pad_size;
                        new_dyn = talloc_zero_array(req->out.vector,
@@ -2249,8 +2275,8 @@ NTSTATUS smbd_smb2_request_done_ex(struct 
smbd_smb2_request *req,
                        memcpy(new_dyn, old_dyn, old_size);
                        memset(new_dyn + old_size, 0, pad_size);
 
-                       req->out.vector[i+2].iov_base = (void *)new_dyn;
-                       req->out.vector[i+2].iov_len = new_size;
+                       outdyn_v->iov_base = (void *)new_dyn;
+                       outdyn_v->iov_len = new_size;
                }
                next_command_ofs += pad_size;
        }
@@ -2266,11 +2292,10 @@ NTSTATUS smbd_smb2_request_error_ex(struct 
smbd_smb2_request *req,
                                    const char *location)
 {
        DATA_BLOB body;
-       int i = req->current_idx;
        uint8_t *outhdr = SMBD_SMB2_OUT_HDR_PTR(req);
 
        DEBUG(10,("smbd_smb2_request_error_ex: idx[%d] status[%s] |%s| at %s\n",
-                 i, nt_errstr(status), info ? " +info" : "",
+                 req->current_idx, nt_errstr(status), info ? " +info" : "",
                  location));
 
        body.data = outhdr + SMB2_HDR_BODY;


-- 
Samba Shared Repository

Reply via email to