summaryrefslogtreecommitdiff
path: root/source3/libsmb
diff options
context:
space:
mode:
authorVolker Lendecke <vl@samba.org>2010-02-28 18:45:41 +0100
committerVolker Lendecke <vl@samba.org>2010-02-28 18:49:59 +0100
commit9ad1b4cda04269dd50a719b4f65de2579d0da220 (patch)
tree64d186d158f610379e1d63fc8cde59ee3d2b5dba /source3/libsmb
parentfb98f60594b6cabc52d0f2f49eda08f793ba4748 (diff)
downloadsamba-9ad1b4cda04269dd50a719b4f65de2579d0da220.tar.gz
samba-9ad1b4cda04269dd50a719b4f65de2579d0da220.tar.bz2
samba-9ad1b4cda04269dd50a719b4f65de2579d0da220.zip
s3: Fix the CHAIN1 torture test
I've tried to solve this just within cli_smb_recv(), but I could not find a way to sanely determine when we are receiving the last entry in the chain just from looking at the blob. This solves it in an a bit more brutal way...
Diffstat (limited to 'source3/libsmb')
-rw-r--r--source3/libsmb/async_smb.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/source3/libsmb/async_smb.c b/source3/libsmb/async_smb.c
index 520861c4c5..2f1f45c0a6 100644
--- a/source3/libsmb/async_smb.c
+++ b/source3/libsmb/async_smb.c
@@ -201,6 +201,7 @@ struct cli_smb_state {
uint8_t *inbuf;
uint32_t seqnum;
int chain_num;
+ int chain_length;
struct tevent_req **chained_requests;
};
@@ -710,6 +711,8 @@ static void cli_smb_received(struct tevent_req *subreq)
state->inbuf = talloc_move(state, &inbuf);
talloc_set_destructor(req, NULL);
cli_smb_req_destructor(req);
+ state->chain_num = 0;
+ state->chain_length = 1;
tevent_req_done(req);
} else {
struct tevent_req **chain = talloc_move(
@@ -721,6 +724,7 @@ static void cli_smb_received(struct tevent_req *subreq)
cli_smb_state);
state->inbuf = inbuf;
state->chain_num = i;
+ state->chain_length = num_chained;
tevent_req_done(chain[i]);
}
TALLOC_FREE(inbuf);
@@ -870,7 +874,11 @@ no_err:
*pbytes = (uint8_t *)state->inbuf + bytes_offset + 2;
}
if ((mem_ctx != NULL) && (pinbuf != NULL)) {
- *pinbuf = talloc_move(mem_ctx, &state->inbuf);
+ if (state->chain_num == state->chain_length-1) {
+ *pinbuf = talloc_move(mem_ctx, &state->inbuf);
+ } else {
+ *pinbuf = state->inbuf;
+ }
}
return status;