[jcifs] SmbComWriteAndX writes corrupt offset to wire

[Richard Heap]

Strictly readInt2 below is readUnsignedInt2
if you knew that the little endian wire bytes represented a signed short 
you should:
down cast the int result back to a java short before using it
or
refactor readInt2 as follows
return ((src[srcIndex + 1] << 8) | (src[srcIndex] & 0xff));
so 00 80 becomes -32768 (rather than +32768)
and 01 80 becomes -32767 (rather than +32769)

this all depends on whether a 'short' goes from -32768 to 32767 or from 
0 to 65535 - as java only has signed shorts the only way to represent an 
unsigned short is with the bottom 16 bits of an int (masked with 0xffff)

Richard Heap wrote:

> yes, certain...
> in the writexxx routines the (byte) down-casting will mask correctly
> demotion casting is generally ok - it's promotion casting where you 
> have to be careful
> like in readInt2
>     static int readInt2( byte[] src, int srcIndex ) {
>         return ( src[srcIndex] & 0xFF ) +
>                 (( src[srcIndex + 1] & 0xFF ) << 8 );
>     }
>
> this *does* need the masks as this boils down to...
> int a = [sign extend] src[srcIndex];
> int b = [sign extend] src[srcIndex + 1];
> a &= 0xff; // trims any sign extension back off to get back to 8 
> significant bits in an int
> b &= 0xff; // ditto
> return (b << 8) + a; // done as integer maths
>
> Michael B Allen wrote:
>
>>eglass1 at comcast.net said:
>>  
>>
>>>>   static void writeInt4( long val, byte[] dst, int dstIndex ) {
>>>>       dst[dstIndex++] = (byte)(val);
>>>>       dst[dstIndex++] = (byte)(val >> 8);
>>>>       dst[dstIndex++] = (byte)(val >> 16);
>>>>       dst[dstIndex++] = (byte)(val >> 32);
>>>>   }
>>>>      
>>>>
>>>The last shift in writeInt4 should be 24, not 32.  It's also faster
>>>(although
>>>probably negligibly for our purposes) to do:
>>>
>>>    static void writeInt4( long val, byte[] dst, int dstIndex ) {
>>>        dst[dstIndex] = (byte)(val);
>>>        dst[++dstIndex] = (byte)(val >>= 8);
>>>        dst[++dstIndex] = (byte)(val >>= 8);
>>>        dst[++dstIndex] = (byte)(val >> 8);
>>>    }
>>>    
>>>
>>
>>Are we certain that the masks are unnecessary? I suppose I was thinking of
>>C when I wrote these routines where the highbit is used to indicate the
>>sign. For example, if an int or short with the highbit is passed to this
>>and the type is promoted to long will the bit pattern still be what we
>>expect?
>>
>>Mike
>>
>>  
>>
-------------- next part --------------
HTML attachment scrubbed and removed