some quite important bug-fixes i missed because i transferred the wrong

smb.tgz file from my portable.

particularly the call to mem_data followed by a realloc of that data in
cli_pipe.c's rpc_read() function.

smbd responses now use p->rdata_i which is a faked-up pointer into
p->rdata's response data.  rdata can be very long; rdata_i is limited
to point to no more than max_tsize - 0x18 in length.  this will make
it an almost trivial task to add the encrypted rpc headers after
rdata_i, and mem_buf_copy will cope admirably with rhdr chained to
rdata_i chained to auth_verifier etc etc...
(This used to be commit 05a297e3a98c14360782af4ad0d851638fb5da9a)

1 files changed, 19 insertions, 12 deletions

diff --git a/source3/rpc_server/srv_util.c b/source3/rpc_server/srv_util.c
index 7ddc2da5d1..59db0bed2c 100644
--- a/source3/rpc_server/srv_util.c
+++ b/source3/rpc_server/srv_util.c
@@ -165,6 +165,9 @@ int make_dom_gids(char *gids_str, DOM_GID **ppgids)
 BOOL create_rpc_reply(pipes_struct *p,
 				uint32 data_start, uint32 data_end)
 {
+	char *data;
+	uint32 data_len;
+
 	DEBUG(5,("create_rpc_reply: data_start: %d data_end: %d max_tsize: %d\n",
 	          data_start, data_end, p->hdr_ba.bba.max_tsize));
 
@@ -197,6 +200,8 @@ BOOL create_rpc_reply(pipes_struct *p,
 		p->hdr.frag_len = p->hdr_ba.bba.max_tsize;
 	}
 
+	data_len = p->hdr.frag_len;
+
 	p->rhdr.data->offset.start = 0;
 	p->rhdr.data->offset.end   = 0x18;
 
@@ -205,6 +210,20 @@ BOOL create_rpc_reply(pipes_struct *p,
 	smb_io_rpc_hdr   ("hdr", &(p->hdr   ), &(p->rhdr), 0);
 	smb_io_rpc_hdr_resp("resp", &(p->hdr_resp), &(p->rhdr), 0);
 
+	p->frag_len_left   = p->hdr.frag_len - p->file_offset;
+	p->next_frag_start = p->hdr.frag_len; 
+	
+	/* don't use rdata: use rdata_i instead, which moves... */
+	/* make a pointer to the rdata data.  NOT A COPY */
+
+	prs_init(&p->rdata_i, 0, p->rdata.align, p->rdata.data->margin, p->rdata.io);
+	data = mem_data(&(p->rdata.data), data_start);
+	mem_create(p->rdata_i.data, data, data_start, data_len, 0, False); 
+
+	/* set up the data chain */
+	prs_link(NULL    , &p->rhdr   , &p->rdata_i);
+	prs_link(&p->rhdr, &p->rdata_i, NULL       );
+
 	return p->rhdr.data != NULL && p->rhdr.offset == 0x18;
 }
 
@@ -703,18 +722,6 @@ BOOL api_rpcTNP(pipes_struct *p, char *rpc_name, struct api_struct *api_rpc_cmds
 		return False;
 	}
 
-	p->frag_len_left   = p->hdr.frag_len - p->file_offset;
-	p->next_frag_start = p->hdr.frag_len; 
-	
-	/* set up the data chain */
-	p->rhdr.data->offset.start = 0;
-	p->rhdr.data->offset.end   = p->rhdr.offset;
-	p->rhdr.data->next = p->rdata.data;
-
-	p->rdata.data->offset.start = p->rhdr.data->offset.end;
-	p->rdata.data->offset.end   = p->rhdr.data->offset.end + p->rdata.offset;
-	p->rdata.data->next = NULL;
-
 	return True;
 }