[jcifs] SMB Sequence Yields Write Corruption

[Michael B Allen]

I've noticed a strange thing (actually a jCIFS user noticed it). Consider
the following sequence of SMBs (to XP Pro SP1 in this case):

  NEGOTIATE
  SESSION_SETUP_ANDX
  TREE_CONNECT_ANDX
  NT_CREATE_ANDX       t.txt
  WRITE_ANDX           "hello1" at offset 0
  CLOSE                t.txt
  NT_CREATE_ANDX       foo.txt
  WRITE_ANDX           "hello2" at offset 6
  CLOSE                t.txt
  DISCONNECT
  LOGOFF

Now if I dump that file I get:

  $ hexdump -c /mnt/pub/t.txt
  0000000  \0  \0  \0  \0  \0  \0   h   e   l   l   o   2

Where did all these zeros come from?

If I pause after the first CLOSE and hexdump the file it is what I expect:

  $ hexdump -c /mnt/pub/t.txt
  0000000   h   e   l   l   o   1

Where's the bug?

Mike

PS: Captures available on request.