From 99274c78a12240f0c4b6533eb9307df3123a2e69 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Tue, 30 Jun 2020 14:00:41 -0700 Subject: [PATCH] s3: libsmb: Fix SMB2 client rename bug to a Windows server. Fix bug where renaming to a target name of one UCS2 character (name length 2 bytes) fails to a Windows 10 SMB2 server. The Windows 10 SMB2 server has a minimum length for a SMB2_FILE_RENAME_INFORMATION buffer of 24 bytes. It returns NT_STATUS_INFO_LENGTH_MISMATCH if the length is less. This isn't an alignment issue as Windows client happily 2-byte align for larget target name sizes. Also the Windows 10 SMB1 server doesn't have this restriction. If the name length is too short, pad out with zeros to 24 bytes. Hard to add a test for this as we don't want to add this silly restriction to the Samba server as it would break all non-Windows clients. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14403 Signed-off-by: Jeremy Allison Reviewed-by: Volker Lendecke Autobuild-User(master): Jeremy Allison Autobuild-Date(master): Wed Jul 1 18:59:53 UTC 2020 on sn-devel-184 (cherry picked from commit f59490dc2d07107d32d6e888f2814011ab2845b7) --- source3/libsmb/cli_smb2_fnum.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/source3/libsmb/cli_smb2_fnum.c b/source3/libsmb/cli_smb2_fnum.c index 4edeefc117d..d33d229e0b0 100644 --- a/source3/libsmb/cli_smb2_fnum.c +++ b/source3/libsmb/cli_smb2_fnum.c @@ -3252,6 +3252,7 @@ NTSTATUS cli_smb2_rename(struct cli_state *cli, smb_ucs2_t *converted_str = NULL; size_t converted_size_bytes = 0; size_t namelen = 0; + size_t inbuf_size; TALLOC_CTX *frame = talloc_stackframe(); if (smbXcli_conn_has_async_calls(cli->conn)) { @@ -3309,8 +3310,29 @@ NTSTATUS cli_smb2_rename(struct cli_state *cli, } converted_size_bytes -= 2; - inbuf = data_blob_talloc_zero(frame, - 20 + converted_size_bytes); + inbuf_size = 20 + converted_size_bytes; + if (inbuf_size < 20) { + /* Integer wrap check. */ + status = NT_STATUS_INVALID_PARAMETER; + goto fail; + } + + /* + * The Windows 10 SMB2 server has a minimum length + * for a SMB2_FILE_RENAME_INFORMATION buffer of + * 24 bytes. It returns NT_STATUS_INFO_LENGTH_MISMATCH + * if the length is less. This isn't an alignment + * issue as Windows client happily 2-byte align + * for larget target name sizes. Also the Windows 10 + * SMB1 server doesn't have this restriction. + * + * BUG: https://bugzilla.samba.org/show_bug.cgi?id=14403 + */ + if (inbuf_size < 24) { + inbuf_size = 24; + } + + inbuf = data_blob_talloc_zero(frame, inbuf_size); if (inbuf.data == NULL) { status = NT_STATUS_NO_MEMORY; goto fail; -- 2.20.1