1 files changed, 25 insertions, 12 deletions

diff --git a/source4/smb_server/smb2/fileio.c b/source4/smb_server/smb2/fileio.c
index b6b35d3d89..5ab217bbfd 100644
--- a/source4/smb_server/smb2/fileio.c
+++ b/source4/smb_server/smb2/fileio.c
@@ -135,7 +135,7 @@ static void smb2srv_flush_send(struct ntvfs_request *ntvfs)
 	SMB2SRV_CHECK_ASYNC_STATUS(io, union smb_flush);
 	SMB2SRV_CHECK(smb2srv_setup_reply(req, 0x04, false, 0));
 
-	SSVAL(req->out.body,	0x02,	0);
+	SSVAL(req->out.body,	0x02,	io->smb2.out.reserved);
 
 	smb2srv_send_reply(req);
 }
@@ -143,15 +143,14 @@ static void smb2srv_flush_send(struct ntvfs_request *ntvfs)
 void smb2srv_flush_recv(struct smb2srv_request *req)
 {
 	union smb_flush *io;
-	uint16_t _pad;
 
 	SMB2SRV_CHECK_BODY_SIZE(req, 0x18, false);
 	SMB2SRV_TALLOC_IO_PTR(io, union smb_flush);
 	SMB2SRV_SETUP_NTVFS_REQUEST(smb2srv_flush_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
 	io->smb2.level			= RAW_FLUSH_SMB2;
-	_pad				= SVAL(req->in.body, 0x02);
-	io->smb2.in.unknown		= IVAL(req->in.body, 0x04);
+	io->smb2.in.reserved1		= SVAL(req->in.body, 0x02);
+	io->smb2.in.reserved2		= IVAL(req->in.body, 0x04);
 	io->smb2.in.file.ntvfs		= smb2srv_pull_handle(req, req->in.body, 0x08);
 
 	SMB2SRV_CHECK_FILE_HANDLE(io->smb2.in.file.ntvfs);
@@ -247,7 +246,7 @@ static void smb2srv_lock_send(struct ntvfs_request *ntvfs)
 	SMB2SRV_CHECK_ASYNC_STATUS_ERR(io, union smb_lock);
 	SMB2SRV_CHECK(smb2srv_setup_reply(req, 0x04, false, 0));
 
-	SSVAL(req->out.body,	0x02,	io->smb2.out.unknown1);
+	SSVAL(req->out.body,	0x02,	io->smb2.out.reserved);
 
 	smb2srv_send_reply(req);
 }
@@ -255,20 +254,34 @@ static void smb2srv_lock_send(struct ntvfs_request *ntvfs)
 void smb2srv_lock_recv(struct smb2srv_request *req)
 {
 	union smb_lock *io;
+	int i;
 
 	SMB2SRV_CHECK_BODY_SIZE(req, 0x30, false);
 	SMB2SRV_TALLOC_IO_PTR(io, union smb_lock);
 	SMB2SRV_SETUP_NTVFS_REQUEST(smb2srv_lock_send, NTVFS_ASYNC_STATE_MAY_ASYNC);
 
 	io->smb2.level			= RAW_LOCK_SMB2;
-
-	io->smb2.in.unknown1		= SVAL(req->in.body, 0x02);
-	io->smb2.in.unknown2		= IVAL(req->in.body, 0x04);
+	io->smb2.in.lock_count		= SVAL(req->in.body, 0x02);
+	io->smb2.in.reserved		= IVAL(req->in.body, 0x04);
 	io->smb2.in.file.ntvfs		= smb2srv_pull_handle(req, req->in.body, 0x08);
-	io->smb2.in.offset		= BVAL(req->in.body, 0x18);
-	io->smb2.in.count		= BVAL(req->in.body, 0x20);
-	io->smb2.in.unknown5		= IVAL(req->in.body, 0x24);
-	io->smb2.in.flags		= IVAL(req->in.body, 0x28);
+	if (req->in.body_size < 24 + 24*(uint64_t)io->smb2.in.lock_count) {
+		DEBUG(0,("%s: lock buffer too small\n", __location__));
+		smb2srv_send_error(req,  NT_STATUS_FOOBAR);
+		return;
+	}
+	io->smb2.in.locks = talloc_array(io, struct smb2_lock_element, 
+					 io->smb2.in.lock_count);
+	if (io->smb2.in.locks == NULL) {
+		smb2srv_send_error(req, NT_STATUS_NO_MEMORY);
+		return;
+	}
+
+	for (i=0;i<io->smb2.in.lock_count;i++) {
+		io->smb2.in.locks[i].offset	= BVAL(req->in.body, 24 + i*24);
+		io->smb2.in.locks[i].length	= BVAL(req->in.body, 32 + i*24);
+		io->smb2.in.locks[i].flags	= IVAL(req->in.body, 40 + i*24);
+		io->smb2.in.locks[i].reserved	= IVAL(req->in.body, 44 + i*24);
+	}
 
 	SMB2SRV_CHECK_FILE_HANDLE(io->smb2.in.file.ntvfs);
 	SMB2SRV_CALL_NTVFS_BACKEND(ntvfs_lock(req->ntvfs, io));