[SCM] Samba Shared Repository - branch master updated

Jeremy Allison jra at samba.org
Wed Mar 5 14:54:04 MST 2014


The branch, master has been updated
       via  032621d s3:smbd: s/BUFFER_SIZE/LARGE_WRITEX_BUFFER_SIZE
       via  c899d4f s3:smbd: fix the maxentries calculation depending on the max_send.
       via  734e1b65 s3:smbd: simplify maxentries calculation in reply_search()
       via  8b746f5 s3:smbd: fix the read numtoread calculation depending on the max_send.
       via  f69be2c s3:smbd: fix the lockread numtoread calculation depending on the max_send.
       via  b86f906 s3:smbd: pass the final numtoread reply_outbuf() for the lockread reply.
       via  3dac00b s3:smbd: fix lockread numtoread calculation to match reply_outbuf() arguments.
       via  2ec49cf s3:smbd: take less than SMB_BUFFER_SIZE_MIN ('500') as header overhead in ipc.c
       via  cce1eae s3:smbd: reject a MaxBufferSize < SMB_BUFFER_SIZE_MIN (500) in a session setup request
       via  5cd5c16 s3:smbd: use sconn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX
       via  a349b0b s3:smbd: use SMB_BUFFER_SIZE_MIN/MAX to limit lp_max_xmit()
       via  7f3faa1 s3:include: let CLI_BUFFER_SIZE be an alias of SMB_BUFFER_SIZE_MAX
       via  900839e libcli/smb: add SMB_BUFFER_SIZE_MIN/MAX defines
       via  74f8c35 s3:param: avoid using BUFFER_SIZE to limit the lp_min_receive_file_size()
       via  f0f245f s3:client: only limit the buffer by the given length 'n'
       via  05e821b s3:torture: use CLI_BUFFER_SIZE instead of BUFFER_SIZE
       via  3667a2e s3:utils/smbfilter: use a local variable for the packet buffer
      from  9ed7555 nsswitch: Remove fallback setting of WINBINDD_SOCKET_DIR

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 032621d5bf842e60dc9cd1cd0d3acc90482462a6
Author: Stefan Metzmacher <metze at samba.org>
Date:   Fri Dec 6 13:56:12 2013 +0100

    s3:smbd: s/BUFFER_SIZE/LARGE_WRITEX_BUFFER_SIZE
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Jeremy Allison <jra at samba.org>
    Autobuild-Date(master): Wed Mar  5 22:53:34 CET 2014 on sn-devel-104

commit c899d4fd9c5a337ab82acdf11866df50fb0629e0
Author: Stefan Metzmacher <metze at samba.org>
Date:   Wed Mar 5 14:03:42 2014 +0100

    s3:smbd: fix the maxentries calculation depending on the max_send.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 734e1b65044a33eba01b41695502c2257c1a4d9e
Author: Stefan Metzmacher <metze at samba.org>
Date:   Wed Mar 5 14:00:40 2014 +0100

    s3:smbd: simplify maxentries calculation in reply_search()
    
    Using helper variables make it much easier to understand.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 8b746f5a2137b74e28bce5370f5aa9d4bcdac6c2
Author: Stefan Metzmacher <metze at samba.org>
Date:   Tue Mar 4 14:07:26 2014 +0100

    s3:smbd: fix the read numtoread calculation depending on the max_send.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit f69be2c28e097c66907df264794706006fe0ae7f
Author: Stefan Metzmacher <metze at samba.org>
Date:   Tue Mar 4 14:07:26 2014 +0100

    s3:smbd: fix the lockread numtoread calculation depending on the max_send.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit b86f90611820bcf7826bd1de3c7b05488a8f1b0e
Author: Stefan Metzmacher <metze at samba.org>
Date:   Tue Mar 4 14:07:26 2014 +0100

    s3:smbd: pass the final numtoread reply_outbuf() for the lockread reply.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 3dac00b568613f5a1322883237e40b98ddd1d71d
Author: Stefan Metzmacher <metze at samba.org>
Date:   Tue Mar 4 14:07:26 2014 +0100

    s3:smbd: fix lockread numtoread calculation to match reply_outbuf() arguments.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 2ec49cf57c88735be962b0681b487df5efe7ed6b
Author: Stefan Metzmacher <metze at samba.org>
Date:   Fri Dec 6 13:53:45 2013 +0100

    s3:smbd: take less than SMB_BUFFER_SIZE_MIN ('500') as header overhead in ipc.c
    
    We're now sure that sconn->smb1.sessions.max_send is >= SMB_BUFFER_SIZE_MIN.
    in order to garantee some progress we need to make sure our assumed
    header overhead is less than SMB_BUFFER_SIZE_MIN.
    
    Assuming 372 bytes for the SMBtrans headers should still be more than
    enough.
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit cce1eaea91088efd742891befdaafade0c1fdce6
Author: Stefan Metzmacher <metze at samba.org>
Date:   Fri Dec 6 13:52:09 2013 +0100

    s3:smbd: reject a MaxBufferSize < SMB_BUFFER_SIZE_MIN (500) in a session setup request
    
    This makes sure sconn->smb1.sessions.max_send is always >= SMB_BUFFER_SIZE_MIN.
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 5cd5c1613996ecebdcd632e932957947f4c27308
Author: Stefan Metzmacher <metze at samba.org>
Date:   Fri Dec 6 13:50:49 2013 +0100

    s3:smbd: use sconn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX
    
    SMB_BUFFER_SIZE_MAX is UINT16_MAX and the largest value a client
    can possibly specify in the session setup request.
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit a349b0bef9085fd139640ec92399bc63d8029cb9
Author: Stefan Metzmacher <metze at samba.org>
Date:   Fri Dec 6 13:45:35 2013 +0100

    s3:smbd: use SMB_BUFFER_SIZE_MIN/MAX to limit lp_max_xmit()
    
    The current limit of 128*1024 causes problems as the value has to be
    <= UINT16_MAX otherwise some clients get confused, as they want to
    use the MaxBufferSize value from the negprot response (uint32_t)
    for the MaxBufferSize value in thet session setup request (uint16_t).
    E.g. Windows 7 (as client) sends MaxBufferSize = 0 if the server value
    is > UINT16_MAX.
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 7f3faa1f1837870195352253fe220e0677565d9e
Author: Stefan Metzmacher <metze at samba.org>
Date:   Fri Dec 6 13:57:15 2013 +0100

    s3:include: let CLI_BUFFER_SIZE be an alias of SMB_BUFFER_SIZE_MAX
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 900839e2216048a614f2f0aeb1f79092fc93334f
Author: Stefan Metzmacher <metze at samba.org>
Date:   Fri Dec 6 13:28:35 2013 +0100

    libcli/smb: add SMB_BUFFER_SIZE_MIN/MAX defines
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=10422
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 74f8c3568a5dcdee108a0526cefac9d282361044
Author: Stefan Metzmacher <metze at samba.org>
Date:   Wed Feb 19 13:59:07 2014 +0100

    s3:param: avoid using BUFFER_SIZE to limit the lp_min_receive_file_size()
    
    There's really no reason to add such limit.
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit f0f245f4c8b1a506e8d06c72d3d6680b95738714
Author: Stefan Metzmacher <metze at samba.org>
Date:   Wed Feb 19 13:57:28 2014 +0100

    s3:client: only limit the buffer by the given length 'n'
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 05e821b220328b88dd9eece919b8adee3e4281ac
Author: Stefan Metzmacher <metze at samba.org>
Date:   Wed Feb 19 13:56:06 2014 +0100

    s3:torture: use CLI_BUFFER_SIZE instead of BUFFER_SIZE
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

commit 3667a2eee388915fca2b894ae37375eeed46e941
Author: Stefan Metzmacher <metze at samba.org>
Date:   Wed Feb 19 13:54:44 2014 +0100

    s3:utils/smbfilter: use a local variable for the packet buffer
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Jeremy Allison <jra at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 libcli/smb/smb_constants.h |    8 ++++++
 source3/client/client.c    |    2 +-
 source3/include/client.h   |    2 +-
 source3/include/smb.h      |    4 +--
 source3/param/loadparm.c   |    2 +-
 source3/smbd/ipc.c         |   10 +++++---
 source3/smbd/process.c     |   11 ++++++--
 source3/smbd/reply.c       |   54 ++++++++++++++++++++++----------------------
 source3/smbd/sesssetup.c   |   19 ++++++++++-----
 source3/torture/torture.c  |    2 +-
 source3/utils/smbfilter.c  |    2 +-
 11 files changed, 68 insertions(+), 48 deletions(-)


Changeset truncated at 500 lines:

diff --git a/libcli/smb/smb_constants.h b/libcli/smb/smb_constants.h
index 4b24be0..4190e64 100644
--- a/libcli/smb/smb_constants.h
+++ b/libcli/smb/smb_constants.h
@@ -209,6 +209,14 @@ enum smb_signing_setting {
 #define NEGOTIATE_SECURITY_SIGNATURES_ENABLED	0x04
 #define NEGOTIATE_SECURITY_SIGNATURES_REQUIRED	0x08
 
+/*
+ * The negotiated buffer size for non LARGE_READX/WRITEX
+ * should be limited to uint16_t and has to be at least
+ * 500, which is the default for MinClientBufferSize on Windows.
+ */
+#define SMB_BUFFER_SIZE_MIN 500
+#define SMB_BUFFER_SIZE_MAX 65535
+
 /* Capabilities.  see ftp.microsoft.com/developr/drg/cifs/cifs/cifs4.txt */
 
 #define CAP_RAW_MODE		0x00000001
diff --git a/source3/client/client.c b/source3/client/client.c
index 5157fc9..9e1f83d 100644
--- a/source3/client/client.c
+++ b/source3/client/client.c
@@ -226,7 +226,7 @@ static int readfile(uint8_t *b, int n, XFILE *f)
 		return x_fread(b,1,n,f);
 
 	i = 0;
-	while (i < (n - 1) && (i < BUFFER_SIZE)) {
+	while (i < (n - 1)) {
 		if ((c = x_getc(f)) == EOF) {
 			break;
 		}
diff --git a/source3/include/client.h b/source3/include/client.h
index 35fa2f1..59fb104 100644
--- a/source3/include/client.h
+++ b/source3/include/client.h
@@ -22,7 +22,7 @@
 #ifndef _CLIENT_H
 #define _CLIENT_H
 
-#define CLI_BUFFER_SIZE (0xFFFF)
+#define CLI_BUFFER_SIZE SMB_BUFFER_SIZE_MAX
 
 /* default client timeout to 20 seconds on most commands */
 #define CLIENT_TIMEOUT (20 * 1000)
diff --git a/source3/include/smb.h b/source3/include/smb.h
index 1f6813e..aab4ff5 100644
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -32,11 +32,9 @@
 /* logged when starting the various Samba daemons */
 #define COPYRIGHT_STARTUP_MESSAGE	"Copyright Andrew Tridgell and the Samba Team 1992-2014"
 
-
-#define BUFFER_SIZE (128*1024)
-
 #define SAFETY_MARGIN 1024
 #define LARGE_WRITEX_HDR_SIZE 65
+#define LARGE_WRITEX_BUFFER_SIZE (128*1024)
 
 #define NMB_PORT 137
 #define DGRAM_PORT 138
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 2114fa3..0565759 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -5204,7 +5204,7 @@ int lp_min_receive_file_size(void)
 	if (Globals.iminreceivefile < 0) {
 		return 0;
 	}
-	return MIN(Globals.iminreceivefile, BUFFER_SIZE);
+	return Globals.iminreceivefile;
 }
 
 /*******************************************************************
diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c
index 91d5047..dbb259c 100644
--- a/source3/smbd/ipc.c
+++ b/source3/smbd/ipc.c
@@ -109,12 +109,14 @@ void send_trans_reply(connection_struct *conn,
 	int lparam = rparam ? rparam_len : 0;
 	struct smbd_server_connection *sconn = req->sconn;
 	int max_send = sconn->smb1.sessions.max_send;
+	/* HACK: make sure we send at least 128 byte in one go */
+	int hdr_overhead = SMB_BUFFER_SIZE_MIN - 128;
 
 	if (buffer_too_large)
 		DEBUG(5,("send_trans_reply: buffer %d too large\n", ldata ));
 
-	this_lparam = MIN(lparam,max_send - 500); /* hack */
-	this_ldata  = MIN(ldata,max_send - (500+this_lparam));
+	this_lparam = MIN(lparam,max_send - hdr_overhead);
+	this_ldata  = MIN(ldata,max_send - (hdr_overhead+this_lparam));
 
 	align = ((this_lparam)%4);
 
@@ -163,9 +165,9 @@ void send_trans_reply(connection_struct *conn,
 	while (tot_data_sent < ldata || tot_param_sent < lparam)
 	{
 		this_lparam = MIN(lparam-tot_param_sent,
-				  max_send - 500); /* hack */
+				  max_send - hdr_overhead);
 		this_ldata  = MIN(ldata -tot_data_sent,
-				  max_send - (500+this_lparam));
+				  max_send - (hdr_overhead+this_lparam));
 
 		if(this_lparam < 0)
 			this_lparam = 0;
diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index 41b3611..9457000 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -245,7 +245,7 @@ static bool valid_packet_size(size_t len)
 	 * of header. Don't print the error if this fits.... JRA.
 	 */
 
-	if (len > (BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
+	if (len > (LARGE_WRITEX_BUFFER_SIZE + LARGE_WRITEX_HDR_SIZE)) {
 		DEBUG(0,("Invalid packet length! (%lu bytes).\n",
 					(unsigned long)len));
 		return false;
@@ -3396,6 +3396,7 @@ void smbd_process(struct tevent_context *ev_ctx,
 	const char *remaddr = NULL;
 	char *rhost;
 	int ret;
+	int tmp;
 
 	conn = talloc_zero(ev_ctx, struct smbXsrv_connection);
 	if (conn == NULL) {
@@ -3692,10 +3693,14 @@ void smbd_process(struct tevent_context *ev_ctx,
 
 	sconn->nbt.got_session = false;
 
-	sconn->smb1.negprot.max_recv = MIN(lp_max_xmit(),BUFFER_SIZE);
+	tmp = lp_max_xmit();
+	tmp = MAX(tmp, SMB_BUFFER_SIZE_MIN);
+	tmp = MIN(tmp, SMB_BUFFER_SIZE_MAX);
+
+	sconn->smb1.negprot.max_recv = tmp;
 
 	sconn->smb1.sessions.done_sesssetup = false;
-	sconn->smb1.sessions.max_send = BUFFER_SIZE;
+	sconn->smb1.sessions.max_send = SMB_BUFFER_SIZE_MAX;
 
 	if (!init_dptrs(sconn)) {
 		exit_server("init_dptrs() failed");
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 3f3bbe1..b189d66 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -1698,11 +1698,10 @@ void reply_search(struct smb_request *req)
 		}
 	} else {
 		unsigned int i;
-		maxentries = MIN(
-			maxentries,
-			((BUFFER_SIZE -
-			  ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
-			 /DIR_STRUCT_SIZE));
+		size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
+		size_t available_space = sconn->smb1.sessions.max_send - hdr_size;
+
+		maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
 
 		DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
 			 directory,lp_dont_descend(ctx, SNUM(conn))));
@@ -3460,6 +3459,7 @@ void reply_lockread(struct smb_request *req)
 	char *data;
 	off_t startpos;
 	size_t numtoread;
+	size_t maxtoread;
 	NTSTATUS status;
 	files_struct *fsp;
 	struct byte_range_lock *br_lck = NULL;
@@ -3490,18 +3490,12 @@ void reply_lockread(struct smb_request *req)
 	numtoread = SVAL(req->vwv+1, 0);
 	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
 
-	numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
-
-	reply_outbuf(req, 5, numtoread + 3);
-
-	data = smb_buf(req->outbuf) + 3;
-
 	/*
 	 * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
 	 * protocol request that predates the read/write lock concept. 
 	 * Thus instead of asking for a read lock here we need to ask
 	 * for a write lock. JRA.
-	 * Note that the requested lock size is unaffected by max_recv.
+	 * Note that the requested lock size is unaffected by max_send.
 	 */
 
 	br_lck = do_lock(req->sconn->msg_ctx,
@@ -3524,16 +3518,22 @@ void reply_lockread(struct smb_request *req)
 	}
 
 	/*
-	 * However the requested READ size IS affected by max_recv. Insanity.... JRA.
+	 * However the requested READ size IS affected by max_send. Insanity.... JRA.
 	 */
+	maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
 
-	if (numtoread > sconn->smb1.negprot.max_recv) {
-		DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
+	if (numtoread > maxtoread) {
+		DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
-			(unsigned int)numtoread,
-			(unsigned int)sconn->smb1.negprot.max_recv));
-		numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
+			(unsigned int)numtoread, (unsigned int)maxtoread,
+			(unsigned int)sconn->smb1.sessions.max_send));
+		numtoread = maxtoread;
 	}
+
+	reply_outbuf(req, 5, numtoread + 3);
+
+	data = smb_buf(req->outbuf) + 3;
+
 	nread = read_file(fsp,data,startpos,numtoread);
 
 	if (nread < 0) {
@@ -3568,10 +3568,10 @@ void reply_read(struct smb_request *req)
 {
 	connection_struct *conn = req->conn;
 	size_t numtoread;
+	size_t maxtoread;
 	ssize_t nread = 0;
 	char *data;
 	off_t startpos;
-	int outsize = 0;
 	files_struct *fsp;
 	struct lock_struct lock;
 	struct smbd_server_connection *sconn = req->sconn;
@@ -3600,17 +3600,17 @@ void reply_read(struct smb_request *req)
 	numtoread = SVAL(req->vwv+1, 0);
 	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
 
-	numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
-
 	/*
-	 * The requested read size cannot be greater than max_recv. JRA.
+	 * The requested read size cannot be greater than max_send. JRA.
 	 */
-	if (numtoread > sconn->smb1.negprot.max_recv) {
-		DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
+	maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
+
+	if (numtoread > maxtoread) {
+		DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
-			(unsigned int)numtoread,
-			(unsigned int)sconn->smb1.negprot.max_recv));
-		numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
+			(unsigned int)numtoread, (unsigned int)maxtoread,
+			(unsigned int)sconn->smb1.sessions.max_send));
+		numtoread = maxtoread;
 	}
 
 	reply_outbuf(req, 5, numtoread+3);
diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
index 02cb445..4b86a99 100644
--- a/source3/smbd/sesssetup.c
+++ b/source3/smbd/sesssetup.c
@@ -383,10 +383,13 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
 		}
 
 		if (!sconn->smb1.sessions.done_sesssetup) {
-			sconn->smb1.sessions.max_send =
-				MIN(sconn->smb1.sessions.max_send,smb_bufsize);
+			if (smb_bufsize < SMB_BUFFER_SIZE_MIN) {
+				reply_force_doserror(req, ERRSRV, ERRerror);
+				return;
+			}
+			sconn->smb1.sessions.max_send = smb_bufsize;
+			sconn->smb1.sessions.done_sesssetup = true;
 		}
-		sconn->smb1.sessions.done_sesssetup = true;
 
 		/* current_user_info is changed on new vuid */
 		reload_services(sconn, conn_snum_used, true);
@@ -1088,10 +1091,14 @@ void reply_sesssetup_and_X(struct smb_request *req)
 	req->vuid = sess_vuid;
 
 	if (!sconn->smb1.sessions.done_sesssetup) {
-		sconn->smb1.sessions.max_send =
-			MIN(sconn->smb1.sessions.max_send,smb_bufsize);
+		if (smb_bufsize < SMB_BUFFER_SIZE_MIN) {
+			reply_force_doserror(req, ERRSRV, ERRerror);
+			END_PROFILE(SMBsesssetupX);
+			return;
+		}
+		sconn->smb1.sessions.max_send = smb_bufsize;
+		sconn->smb1.sessions.done_sesssetup = true;
 	}
-	sconn->smb1.sessions.done_sesssetup = true;
 
 	END_PROFILE(SMBsesssetupX);
 }
diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index 1f29a70..340f754 100644
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -3087,7 +3087,7 @@ static bool run_randomipc(int dummy)
 
 		cli_api(cli, 
 			param, param_len, 8,  
-			NULL, 0, BUFFER_SIZE, 
+			NULL, 0, CLI_BUFFER_SIZE,
 			&rparam, &rprcnt,     
 			&rdata, &rdrcnt);
 		if (i % 100 == 0) {
diff --git a/source3/utils/smbfilter.c b/source3/utils/smbfilter.c
index 33f1a90..734971b 100644
--- a/source3/utils/smbfilter.c
+++ b/source3/utils/smbfilter.c
@@ -35,7 +35,6 @@
 #define CLI_CAPABILITY_SET  0
 
 static char *netbiosname;
-static char packet[BUFFER_SIZE];
 
 static void save_file(const char *fname, void *ppacket, size_t length)
 {
@@ -178,6 +177,7 @@ static void filter_child(int c, struct sockaddr_storage *dest_ss)
 {
 	NTSTATUS status;
 	int s = -1;
+	uint8_t packet[128*1024];
 
 	/* we have a connection from a new client, now connect to the server */
 	status = open_socket_out(dest_ss, TCP_SMB_PORT, LONG_CONNECT_TIMEOUT, &s);


-- 
Samba Shared Repository


More information about the samba-cvs mailing list