[jcifs] AndXServerMessageBlock bug

[Glenn Dix]

Greetings JCIFS community,

I've been troubleshooting a problem with SmbFile.listFiles calls failing due
to SmbTree.send throwing an exception at line 92 because service "A:" is not
properly parsed from the Tree Connect AndX Response coming from an EMC
Celerra. In a response from the Celerra, the "A:" is at offset 31 within the
SMB datagram, whereas in a response from the Win2k3 SP2 server, the "A:" is
at offset 29 within the SMB datagram.

These error log exerpts are from executing ListFiles with
jcifs.util.loglevel=7.

Service is successfully parsed from a response from a Windows 2003 SP2
Server:

SmbComTreeConnectAndXResponse[command=SMB_COM_TREE_CONNECT_ANDX,received=false,errorCode=0,flags=0x0098,flags2=0xC803,signSeq=0,tid=34818,pid=23242,uid=2048,mid=4,wordCount=3,byteCount=13,andxCommand=0xFF,andxOffset=54,supportSearchBits=true,shareIsInDfs=false,service=A:,nativeFileSystem=]
00000: FF 53 4D 42 75 00 00 00 00 98 03 C8 00 00 00 00  |ÿSMBu......È....|
00010: 00 00 00 00 00 00 00 00 02 88 CA 5A 00 08 04 00  |..........ÊZ....|
00020: 03 FF 00 36 00 01 00 0D 00 41 3A 00 4E 00 54 00  |.ÿ.6.....A:.N.T.|
00030: 46 00 53 00 00 00                                |F.S...          |

Service is not successfully parsed from a response from an EMC Celerra:

SmbComTreeConnectAndXResponse[command=SMB_COM_TREE_CONNECT_ANDX,received=false,errorCode=0,flags=0x0081,flags2=0x8801,signSeq=0,tid=63,pid=16388,uid=63,mid=4,wordCount=7,byteCount=511,andxCommand=0xFF,andxOffset=0,supportSearchBits=true,shareIsInDfs=false,service=
,nativeFileSystem=]
00000: FF 53 4D 42 75 00 00 00 00 81 01 88 00 00 00 00  |ÿSMBu...........|
00010: 00 00 00 00 00 00 00 00 3F 00 04 40 3F 00 04 00  |........?..@?...|
00020: 07 FF 00 00 00 01 00 FF 01 1F 00 FF 01 1F 00 0D  |.ÿ.....ÿ...ÿ....|
00030: 00 41 3A 00 4E 00 54 00 46 00 53 00 00 00        |.A:.N.T.F.S...  |

The bufferIndex is not advanced correctly after the
SmbComTreeConnectAndXResponse.readParameterWordsWireFormat call based on the
word count being 7 rather than 3. This
causes SmbComTreeConnectAndXResponse.readBytesWireFormat to read from the
wrong position when parsing the service string.

Here's what worked for me:

Insert the following to AndXServerMessageBlock.java between lines 216 and
217:

 if (command == SMB_COM_TREE_CONNECT_ANDX) {
 if( wordCount > 3 ){
  bufferIndex += (2*(wordCount - 3));
 }
}
-------------- next part --------------
HTML attachment scrubbed and removed