svn commit: samba r8608 - in trunk/source/smbd: .

[jra at samba.org]

Author: jra
Date: 2005-07-19 17:38:36 +0000 (Tue, 19 Jul 2005)
New Revision: 8608

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=8608

Log:
Fix for bugid #2889. I think the problem is that the top 16 bits of the "server state" field must be
non-zero. As we're using the 32 bit field as an offset then normally this field
will be zero. W2K3 fills this field with a counter enumerating the number of
SMBsearch calls on this directory - starting at 1. Add back the 1<<31 bit flag
DPTR_MASK to ensure this is non-zero - with better checks on use.
Jeremy.

Modified:
   trunk/source/smbd/dir.c
   trunk/source/smbd/reply.c


Changeset:
Modified: trunk/source/smbd/dir.c
===================================================================
--- trunk/source/smbd/dir.c	2005-07-19 16:22:42 UTC (rev 8607)
+++ trunk/source/smbd/dir.c	2005-07-19 17:38:36 UTC (rev 8608)
@@ -641,6 +641,8 @@
  Fill the 5 byte server reserved dptr field.
 ****************************************************************************/
 
+#define DPTR_MASK ((uint32)(((uint32)1)<<31))
+
 BOOL dptr_fill(char *buf1,unsigned int key)
 {
 	unsigned char *buf = (unsigned char *)buf1;
@@ -653,8 +655,12 @@
 	offset = (uint32)TellDir(dptr->dir_hnd);
 	DEBUG(6,("fill on key %u dirptr 0x%lx now at %d\n",key,
 		(long)dptr->dir_hnd,(int)offset));
+	if (offset != (uint32)-1 && (offset & DPTR_MASK)) {
+		DEBUG(0,("dptr_fill: Error - offset has bit 32 set. Can't use in server state.\n"));
+		return False;
+	}
 	buf[0] = key;
-	SIVAL(buf,1,offset);
+	SIVAL(buf,1,offset | DPTR_MASK);
 	return(True);
 }
 
@@ -678,7 +684,7 @@
 	if (offset == (uint32)-1) {
 		seekoff = -1;
 	} else {
-		seekoff = (long)offset;
+		seekoff = (long)(offset & ~DPTR_MASK);
 	}
 	SeekDir(dptr->dir_hnd,seekoff);
 	DEBUG(3,("fetching dirptr %d for path %s at offset %d\n",

Modified: trunk/source/smbd/reply.c
===================================================================
--- trunk/source/smbd/reply.c	2005-07-19 16:22:42 UTC (rev 8607)
+++ trunk/source/smbd/reply.c	2005-07-19 17:38:36 UTC (rev 8608)
@@ -1156,7 +1156,9 @@
 						memcpy(p,status,21);
 						make_dir_struct(p,mask,fname,size, mode,date,
 								!allow_long_path_components);
-						dptr_fill(p+12,dptr_num);
+						if (!dptr_fill(p+12,dptr_num)) {
+							break;
+						}
 						numentries++;
 						p += DIR_STRUCT_SIZE;
 					}