r24130: Explicitly pass flags2 to srvstr_push

This is in preparation of the trans2 conversion: srvstr_push should not
look at inbuf directly.

6 files changed, 83 insertions, 35 deletions

diff --git a/source/include/safe_string.h b/source/include/safe_string.h
index 8c4d90c44a3..c0b9c411ec5 100644
--- a/source/include/safe_string.h
+++ b/source/include/safe_string.h
@@ -167,7 +167,7 @@ size_t __unsafe_string_function_usage_here_char__(void);
 #define pull_string_talloc(ctx, base_ptr, smb_flags2, dest, src, src_len, flags) pull_string_talloc_fn2(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, ctx, base_ptr, smb_flags2, dest, src, src_len, flags)
 #define clistr_push(cli, dest, src, dest_len, flags) clistr_push_fn2(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, cli, dest, src, dest_len, flags)
 #define clistr_pull(cli, dest, src, dest_len, src_len, flags) clistr_pull_fn2(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, cli, dest, src, dest_len, src_len, flags)
-#define srvstr_push(base_ptr, dest, src, dest_len, flags) srvstr_push_fn2(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, base_ptr, dest, src, dest_len, flags)
+#define srvstr_push(base_ptr, smb_flags2, dest, src, dest_len, flags) srvstr_push_fn2(SAFE_STRING_FUNCTION_NAME, SAFE_STRING_LINE, base_ptr, smb_flags2, dest, src, dest_len, flags)
 
 #define alpha_strcpy(dest,src,other_safe_chars,maxlength) alpha_strcpy_fn(SAFE_STRING_FUNCTION_NAME,SAFE_STRING_LINE,dest,src,other_safe_chars,maxlength)
 #define StrnCpy(dest,src,n)		StrnCpy_fn(SAFE_STRING_FUNCTION_NAME,SAFE_STRING_LINE,dest,src,n)
@@ -211,10 +211,10 @@ size_t __unsafe_string_function_usage_here_char__(void);
     ? __unsafe_string_function_usage_here_size_t__() \
     : clistr_pull_fn(fn_name, fn_line, cli, dest, src, dest_len, srclen, flags))
 
-#define srvstr_push_fn2(fn_name, fn_line, base_ptr, dest, src, dest_len, flags) \
+#define srvstr_push_fn2(fn_name, fn_line, base_ptr, smb_flags2, dest, src, dest_len, flags) \
     (CHECK_STRING_SIZE(dest, dest_len) \
     ? __unsafe_string_function_usage_here_size_t__() \
-    : srvstr_push_fn(fn_name, fn_line, base_ptr, dest, src, dest_len, flags))
+    : srvstr_push_fn(fn_name, fn_line, base_ptr, smb_flags2, dest, src, dest_len, flags))
 
 #else
 
diff --git a/source/smbd/lanman.c b/source/smbd/lanman.c
index 3568bb55b9e..f7a4f9b0bde 100644
--- a/source/smbd/lanman.c
+++ b/source/smbd/lanman.c
@@ -2866,7 +2866,7 @@ static BOOL api_RNetServerGetInfo(connection_struct *conn,uint16 vuid,
 	p = *rdata;
 	p2 = p + struct_len;
 	if (uLevel != 20) {
-		srvstr_push(NULL, p,global_myname(),16, 
+		srvstr_push(NULL, 0, p,global_myname(),16,
 			STR_ASCII|STR_UPPER|STR_TERMINATE);
   	}
 	p += 16;
diff --git a/source/smbd/nttrans.c b/source/smbd/nttrans.c
index 3676079ec84..c091ed1e71a 100644
--- a/source/smbd/nttrans.c
+++ b/source/smbd/nttrans.c
@@ -2571,7 +2571,10 @@ static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *ou
 			shadow_data->num_volumes,fsp->fsp_name));
 		if (labels && shadow_data->labels) {
 			for (i=0;i<shadow_data->num_volumes;i++) {
-				srvstr_push(outbuf, cur_pdata, shadow_data->labels[i], 2*sizeof(SHADOW_COPY_LABEL), STR_UNICODE|STR_TERMINATE);
+				srvstr_push(outbuf, SVAL(outbuf, smb_flg2),
+					    cur_pdata, shadow_data->labels[i],
+					    2*sizeof(SHADOW_COPY_LABEL),
+					    STR_UNICODE|STR_TERMINATE);
 				cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
 				DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
 			}
diff --git a/source/smbd/reply.c b/source/smbd/reply.c
index cebb905a9e7..4fbf179797c 100644
--- a/source/smbd/reply.c
+++ b/source/smbd/reply.c
@@ -715,9 +715,13 @@ int reply_ioctl(connection_struct *conn,
 				return(UNIXERROR(ERRDOS,ERRbadfid));
 			}
 			SSVAL(p,0,fsp->rap_print_jobid);             /* Job number */
-			srvstr_push(outbuf, p+2, global_myname(), 15, STR_TERMINATE|STR_ASCII);
+			srvstr_push(outbuf, SVAL(outbuf, smb_flg2), p+2,
+				    global_myname(), 15,
+				    STR_TERMINATE|STR_ASCII);
 			if (conn) {
-				srvstr_push(outbuf, p+18, lp_servicename(SNUM(conn)), 13, STR_TERMINATE|STR_ASCII);
+				srvstr_push(outbuf, SVAL(outbuf, smb_flg2),
+					    p+18, lp_servicename(SNUM(conn)),
+					    13, STR_TERMINATE|STR_ASCII);
 			}
 			break;
 		}
@@ -1909,7 +1913,8 @@ int reply_ctemp(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
 	   thing in the byte section. JRA */
 	SSVALS(p, 0, -1); /* what is this? not in spec */
 #endif
-	namelen = srvstr_push(outbuf, p, s, -1, STR_ASCII|STR_TERMINATE);
+	namelen = srvstr_push(outbuf, SVAL(outbuf, smb_flg2), p, s, -1,
+			      STR_ASCII|STR_TERMINATE);
 	p += namelen;
 	outsize = set_message_end(inbuf,outbuf, p);
 
@@ -3903,7 +3908,8 @@ int reply_printqueue(connection_struct *conn,
 			SSVAL(p,5, queue[i].job);
 			SIVAL(p,7,queue[i].size);
 			SCVAL(p,11,0);
-			srvstr_push(outbuf, p+12, queue[i].fs_user, 16, STR_ASCII);
+			srvstr_push(outbuf, SVAL(outbuf, smb_flg2), p+12,
+				    queue[i].fs_user, 16, STR_ASCII);
 			p += 28;
 		}
 
diff --git a/source/smbd/srvstr.c b/source/smbd/srvstr.c
index 1daa25553f8..df993537ba9 100644
--- a/source/smbd/srvstr.c
+++ b/source/smbd/srvstr.c
@@ -24,7 +24,7 @@ extern int max_send;
 /* Make sure we can't write a string past the end of the buffer */
 
 size_t srvstr_push_fn(const char *function, unsigned int line, 
-		      const char *base_ptr, void *dest, 
+		      const char *base_ptr, uint16 smb_flags2, void *dest,
 		      const char *src, int dest_len, int flags)
 {
 	size_t buf_used = PTR_DIFF(dest, base_ptr);
@@ -68,8 +68,8 @@ ssize_t message_push_string(uint8 **outbuf, const char *str, int flags)
 		return -1;
 	}
 
-	result = srvstr_push((char *)tmp, tmp + buf_size, str, grow_size,
-			     flags);
+	result = srvstr_push((char *)tmp, SVAL(tmp, smb_flg2),
+			     tmp + buf_size, str, grow_size, flags);
 
 	if (result == (size_t)-1) {
 		DEBUG(0, ("srvstr_push failed\n"));
diff --git a/source/smbd/trans2.c b/source/smbd/trans2.c
index 2b0925d195b..8b4b36a7fac 100644
--- a/source/smbd/trans2.c
+++ b/source/smbd/trans2.c
@@ -1303,7 +1303,8 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 			p += 23;
 			nameptr = p;
 			p += align_string(outbuf, p, 0);
-			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2), p,
+					  fname, -1, STR_TERMINATE);
 			if (SVAL(outbuf, smb_flg2) & FLAGS2_UNICODE_STRINGS) {
 				if (len > 2) {
 					SCVAL(nameptr, -1, len - 2);
@@ -1338,7 +1339,9 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 			}
 			p += 27;
 			nameptr = p - 1;
-			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE | STR_NOALIGN);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2),
+					  p, fname, -1,
+					  STR_TERMINATE | STR_NOALIGN);
 			if (SVAL(outbuf, smb_flg2) & FLAGS2_UNICODE_STRINGS) {
 				if (len > 2) {
 					len -= 2;
@@ -1394,7 +1397,9 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 			/* Push the ea_data followed by the name. */
 			p += fill_ea_buffer(ea_ctx, p, space_remaining, conn, name_list);
 			nameptr = p;
-			len = srvstr_push(outbuf, p + 1, fname, -1, STR_TERMINATE | STR_NOALIGN);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2),
+					  p + 1, fname, -1,
+					  STR_TERMINATE | STR_NOALIGN);
 			if (SVAL(outbuf, smb_flg2) & FLAGS2_UNICODE_STRINGS) {
 				if (len > 2) {
 					len -= 2;
@@ -1442,7 +1447,10 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 				mangle_map(mangled_name,True,True,
 					   conn->params);
 				mangled_name[12] = 0;
-				len = srvstr_push(outbuf, p+2, mangled_name, 24, STR_UPPER|STR_UNICODE);
+				len = srvstr_push(outbuf,
+						  SVAL(outbuf, smb_flg2),
+						  p+2, mangled_name, 24,
+						  STR_UPPER|STR_UNICODE);
 				if (len < 24) {
 					memset(p + 2 + len,'\0',24 - len);
 				}
@@ -1451,7 +1459,8 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 				memset(p,'\0',26);
 			}
 			p += 2 + 24;
-			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2), p,
+					  fname, -1, STR_TERMINATE_ASCII);
 			SIVAL(q,0,len);
 			p += len;
 			SIVAL(p,0,0); /* Ensure any padding is null. */
@@ -1472,7 +1481,9 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 			SOFF_T(p,0,file_size); p += 8;
 			SOFF_T(p,0,allocation_size); p += 8;
 			SIVAL(p,0,nt_extmode); p += 4;
-			len = srvstr_push(outbuf, p + 4, fname, -1, STR_TERMINATE_ASCII);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2),
+					  p + 4, fname, -1,
+					  STR_TERMINATE_ASCII);
 			SIVAL(p,0,len);
 			p += 4 + len;
 			SIVAL(p,0,0); /* Ensure any padding is null. */
@@ -1499,7 +1510,8 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 				SIVAL(p,0,ea_size); /* Extended attributes */
 				p +=4;
 			}
-			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2), p,
+					  fname, -1, STR_TERMINATE_ASCII);
 			SIVAL(q, 0, len);
 			p += len;
 
@@ -1517,7 +1529,8 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 			p += 4;
 			/* this must *not* be null terminated or w2k gets in a loop trying to set an
 			   acl on a dir (tridge) */
-			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2),
+					  p, fname, -1, STR_TERMINATE_ASCII);
 			SIVAL(p, -4, len);
 			p += len;
 			SIVAL(p,0,0); /* Ensure any padding is null. */
@@ -1547,7 +1560,8 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 			SIVAL(p,0,0); p += 4; /* Unknown - reserved ? */
 			SIVAL(p,0,sbuf.st_ino); p += 4; /* FileIndexLow */
 			SIVAL(p,0,sbuf.st_dev); p += 4; /* FileIndexHigh */
-			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2), p,
+					  fname, -1, STR_TERMINATE_ASCII);
 			SIVAL(q, 0, len);
 			p += len; 
 			SIVAL(p,0,0); /* Ensure any padding is null. */
@@ -1585,7 +1599,10 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 				mangle_map(mangled_name,True,True,
 					   conn->params);
 				mangled_name[12] = 0;
-				len = srvstr_push(outbuf, p+2, mangled_name, 24, STR_UPPER|STR_UNICODE);
+				len = srvstr_push(outbuf,
+						  SVAL(outbuf, smb_flg2),
+						  p+2, mangled_name, 24,
+						  STR_UPPER|STR_UNICODE);
 				SSVAL(p, 0, len);
 				if (len < 24) {
 					memset(p + 2 + len,'\0',24 - len);
@@ -1598,7 +1615,8 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 			SSVAL(p,0,0); p += 2; /* Reserved ? */
 			SIVAL(p,0,sbuf.st_ino); p += 4; /* FileIndexLow */
 			SIVAL(p,0,sbuf.st_dev); p += 4; /* FileIndexHigh */
-			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2), p,
+					  fname, -1, STR_TERMINATE_ASCII);
 			SIVAL(q,0,len);
 			p += len;
 			SIVAL(p,0,0); /* Ensure any padding is null. */
@@ -1621,14 +1639,19 @@ static BOOL get_lanman2_dir_entry(connection_struct *conn,
 				DEBUG(10,("get_lanman2_dir_entry: SMB_FIND_FILE_UNIX\n"));
 				p = store_file_unix_basic(conn, p,
 							NULL, &sbuf);
-				len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE);
+				len = srvstr_push(outbuf,
+						  SVAL(outbuf, smb_flg2),
+						  p, fname, -1,
+						  STR_TERMINATE);
 			} else {
 				DEBUG(10,("get_lanman2_dir_entry: SMB_FIND_FILE_UNIX_INFO2\n"));
 				p = store_file_unix_basic_info2(conn, p,
 							NULL, &sbuf);
 				nameptr = p;
 				p += 4;
-				len = srvstr_push(outbuf, p, fname, -1, 0);
+				len = srvstr_push(outbuf,
+						  SVAL(outbuf, smb_flg2),
+						  p, fname, -1, 0);
 				SIVAL(nameptr, 0, len);
 			}
 
@@ -2341,7 +2364,9 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)st.st_dev, (unsi
 			 * this call so try fixing this by adding a terminating null to
 			 * the pushed string. The change here was adding the STR_TERMINATE. JRA.
 			 */
-			len = srvstr_push(outbuf, pdata+l2_vol_szVolLabel, vname, -1, STR_NOALIGN|STR_TERMINATE);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2),
+					  pdata+l2_vol_szVolLabel, vname,
+					  -1, STR_NOALIGN|STR_TERMINATE);
 			SCVAL(pdata,l2_vol_cch,len);
 			data_len = l2_vol_szVolLabel + len;
 			DEBUG(5,("call_trans2qfsinfo : time = %x, namelen = %d, name = %s\n",
@@ -2365,14 +2390,16 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)st.st_dev, (unsi
 			SIVAL(pdata,4,255); /* Max filename component length */
 			/* NOTE! the fstype must *not* be null terminated or win98 won't recognise it
 				and will think we can't do long filenames */
-			len = srvstr_push(outbuf, pdata+12, fstype, -1, STR_UNICODE);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2),
+					  pdata+12, fstype, -1, STR_UNICODE);
 			SIVAL(pdata,8,len);
 			data_len = 12 + len;
 			break;
 
 		case SMB_QUERY_FS_LABEL_INFO:
 		case SMB_FS_LABEL_INFORMATION:
-			len = srvstr_push(outbuf, pdata+4, vname, -1, 0);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2),
+					  pdata+4, vname, -1, 0);
 			data_len = 4 + len;
 			SIVAL(pdata,0,len);
 			break;
@@ -2388,7 +2415,8 @@ cBytesSector=%u, cUnitTotal=%u, cUnitAvail=%d\n", (unsigned int)st.st_dev, (unsi
 				(str_checksum(get_local_machine_name())<<16));
 
 			/* Max label len is 32 characters. */
-			len = srvstr_push(outbuf, pdata+18, vname, -1, STR_UNICODE);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2),
+					  pdata+18, vname, -1, STR_UNICODE);
 			SIVAL(pdata,12,len);
 			data_len = 18+len;
 
@@ -3752,7 +3780,9 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
 			if(!mangle_is_8_3(short_name, True, conn->params)) {
 				mangle_map(short_name,True,True,conn->params);
 			}
-			len = srvstr_push(outbuf, pdata+4, short_name, -1, STR_UNICODE);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2),
+					  pdata+4, short_name, -1,
+					  STR_UNICODE);
 			data_size = 4 + len;
 			SIVAL(pdata,0,len);
 			break;
@@ -3762,7 +3792,8 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
 			/*
 			  this must be *exactly* right for ACLs on mapped drives to work
 			 */
-			len = srvstr_push(outbuf, pdata+4, dos_fname, -1, STR_UNICODE);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2),
+					  pdata+4, dos_fname, -1, STR_UNICODE);
 			DEBUG(10,("call_trans2qfilepathinfo: SMB_QUERY_FILE_NAME_INFO\n"));
 			data_size = 4 + len;
 			SIVAL(pdata,0,len);
@@ -3803,7 +3834,8 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
 			pdata += 24;
 			SIVAL(pdata,0,ea_size);
 			pdata += 4; /* EA info */
-			len = srvstr_push(outbuf, pdata+4, dos_fname, -1, STR_UNICODE);
+			len = srvstr_push(outbuf, SVAL(outbuf, smb_flg2),
+					  pdata+4, dos_fname, -1, STR_UNICODE);
 			SIVAL(pdata,0,len);
 			pdata += 4 + len;
 			data_size = PTR_DIFF(pdata,(*ppdata));
@@ -3965,7 +3997,10 @@ total_data=%u (should be %u)\n", (unsigned int)total_data, (unsigned int)IVAL(pd
 				if (len == -1)
 					return(UNIXERROR(ERRDOS,ERRnoaccess));
 				buffer[len] = 0;
-				len = srvstr_push(outbuf, pdata, buffer, -1, STR_TERMINATE);
+				len = srvstr_push(outbuf,
+						  SVAL(outbuf, smb_flg2),
+						  pdata, buffer, -1,
+						  STR_TERMINATE);
 				pdata += len;
 				data_size = PTR_DIFF(pdata,(*ppdata));
 
@@ -6485,8 +6520,12 @@ static int call_trans2ioctl(connection_struct *conn, char* inbuf, char* outbuf,
 			CAN ACCEPT THIS IN UNICODE. JRA. */
 
 		SSVAL(pdata,0,fsp->rap_print_jobid);                     /* Job number */
-		srvstr_push( outbuf, pdata + 2, global_myname(), 15, STR_ASCII|STR_TERMINATE); /* Our NetBIOS name */
-		srvstr_push( outbuf, pdata+18, lp_servicename(SNUM(conn)), 13, STR_ASCII|STR_TERMINATE); /* Service name */
+		srvstr_push( outbuf, SVAL(outbuf, smb_flg2), pdata + 2,
+			     global_myname(), 15,
+			     STR_ASCII|STR_TERMINATE); /* Our NetBIOS name */
+		srvstr_push( outbuf, SVAL(outbuf, smb_flg2), pdata+18,
+			     lp_servicename(SNUM(conn)), 13,
+			     STR_ASCII|STR_TERMINATE); /* Service name */
 		send_trans2_replies(inbuf, outbuf,bufsize,*pparams,0,*ppdata,32, max_data_bytes);
 		return(-1);
 	} else {