From 7f9d6f80efbc211977b13ece80fff6adbea929ac Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Sat, 1 Nov 2008 16:24:42 +0100
Subject: Add a "buflen" struct member to smb_request

This removes some explicit inbuf references and also removes a pointless check
in reply_echo. The buflen can never be more than 64k, this is just a 16 bit
value.
---
 source3/smbd/reply.c | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 25480c6e3b..2d7e557980 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -523,7 +523,7 @@ void reply_tcon(struct smb_request *req)
 
 	START_PROFILE(SMBtcon);
 
-	if (smb_buflen(req->inbuf) < 4) {
+	if (req->buflen < 4) {
 		reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 		END_PROFILE(SMBtcon);
 		return;
@@ -614,7 +614,7 @@ void reply_tcon_and_X(struct smb_request *req)
 		conn = NULL;
 	}
 
-	if ((passlen > MAX_PASS_LEN) || (passlen >= smb_buflen(req->inbuf))) {
+	if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 		reply_doserror(req, ERRDOS, ERRbuftoosmall);
 		END_PROFILE(SMBtconX);
 		return;
@@ -4562,7 +4562,6 @@ void reply_echo(struct smb_request *req)
 	connection_struct *conn = req->conn;
 	int smb_reverb;
 	int seq_num;
-	unsigned int data_len = smb_buflen(req->inbuf);
 
 	START_PROFILE(SMBecho);
 
@@ -4572,20 +4571,13 @@ void reply_echo(struct smb_request *req)
 		return;
 	}
 
-	if (data_len > BUFFER_SIZE) {
-		DEBUG(0,("reply_echo: data_len too large.\n"));
-		reply_nterror(req, NT_STATUS_INSUFFICIENT_RESOURCES);
-		END_PROFILE(SMBecho);
-		return;
-	}
-
 	smb_reverb = SVAL(req->inbuf,smb_vwv0);
 
-	reply_outbuf(req, 1, data_len);
+	reply_outbuf(req, 1, req->buflen);
 
 	/* copy any incoming data back out */
-	if (data_len > 0) {
-		memcpy(smb_buf(req->outbuf),smb_buf(req->inbuf),data_len);
+	if (req->buflen > 0) {
+		memcpy(smb_buf(req->outbuf), smb_buf(req->inbuf), req->buflen);
 	}
 
 	if (smb_reverb > 100) {
@@ -4835,7 +4827,7 @@ void reply_printwrite(struct smb_request *req)
 
 	numtowrite = SVAL(smb_buf(req->inbuf),1);
 
-	if (smb_buflen(req->inbuf) < numtowrite + 3) {
+	if (req->buflen < numtowrite + 3) {
 		reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 		END_PROFILE(SMBsplwr);
 		return;
@@ -6746,7 +6738,7 @@ void reply_lockingX(struct smb_request *req)
 
 	release_level_2_oplocks_on_change(fsp);
 
-	if (smb_buflen(req->inbuf) <
+	if (req->buflen <
 	    (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
 		reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 		END_PROFILE(SMBlockingX);
-- 
cgit 


From ab0561f3c39b2d10cc7d82940c9ec4bd7e4e16f8 Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Sat, 1 Nov 2008 17:22:15 +0100
Subject: Apply some const to get_lock_*()

---
 source3/smbd/reply.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 2d7e557980..c5abac77e2 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -6476,7 +6476,8 @@ void reply_copy(struct smb_request *req)
  Get a lock pid, dealing with large count requests.
 ****************************************************************************/
 
-uint32 get_lock_pid( char *data, int data_offset, bool large_file_format)
+uint32 get_lock_pid(const uint8_t *data, int data_offset,
+		    bool large_file_format)
 {
 	if(!large_file_format)
 		return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
@@ -6488,7 +6489,8 @@ uint32 get_lock_pid( char *data, int data_offset, bool large_file_format)
  Get a lock count, dealing with large count requests.
 ****************************************************************************/
 
-uint64_t get_lock_count( char *data, int data_offset, bool large_file_format)
+uint64_t get_lock_count(const uint8_t *data, int data_offset,
+			bool large_file_format)
 {
 	uint64_t count = 0;
 
@@ -6560,7 +6562,8 @@ static uint32 map_lock_offset(uint32 high, uint32 low)
  Get a lock offset, dealing with large offset requests.
 ****************************************************************************/
 
-uint64_t get_lock_offset( char *data, int data_offset, bool large_file_format, bool *err)
+uint64_t get_lock_offset(const uint8_t *data, int data_offset,
+			 bool large_file_format, bool *err)
 {
 	uint64_t offset = 0;
 
-- 
cgit 


From cc546c019159608744127eb19db0a39e38ed18c7 Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Sat, 1 Nov 2008 17:28:25 +0100
Subject: In reply_search(), don't write to inbuf when splitting directory and
 mask

---
 source3/smbd/reply.c | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index c5abac77e2..8e80a219d4 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -1339,27 +1339,21 @@ void reply_search(struct smb_request *req)
 		}
 
 		p = strrchr_m(directory,'/');
-		if (!p) {
+		if ((p != NULL) && (*directory != '/')) {
+			mask = p + 1;
+			directory = talloc_strndup(ctx, directory,
+						   PTR_DIFF(p, directory));
+		} else {
 			mask = directory;
 			directory = talloc_strdup(ctx,".");
-			if (!directory) {
-				reply_nterror(req, NT_STATUS_NO_MEMORY);
-				END_PROFILE(SMBsearch);
-				return;
-			}
-		} else {
-			*p = 0;
-			mask = p+1;
 		}
 
-		if (*directory == '\0') {
-			directory = talloc_strdup(ctx,".");
-			if (!directory) {
-				reply_nterror(req, NT_STATUS_NO_MEMORY);
-				END_PROFILE(SMBsearch);
-				return;
-			}
+		if (!directory) {
+			reply_nterror(req, NT_STATUS_NO_MEMORY);
+			END_PROFILE(SMBsearch);
+			return;
 		}
+
 		memset((char *)status,'\0',21);
 		SCVAL(status,0,(dirtype & 0x1F));
 
-- 
cgit 


From ac97d7d4b023db8d0e0fef1dc7f2f7b88028eae3 Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Sat, 1 Nov 2008 17:30:37 +0100
Subject: In reply_copy, don't write to inbuf when splitting directory and mask

---
 source3/smbd/reply.c | 33 ++++++++++++++-------------------
 1 file changed, 14 insertions(+), 19 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 8e80a219d4..bbdf34e3e9 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -6141,8 +6141,9 @@ void reply_copy(struct smb_request *req)
 	char *name = NULL;
 	char *newname = NULL;
 	char *directory = NULL;
-	char *mask = NULL;
-	char *p;
+	const char *mask = NULL;
+	const char mask_star[] = "*";
+	const char *p;
 	int count=0;
 	int error = ERRnoaccess;
 	int err = 0;
@@ -6269,23 +6270,18 @@ void reply_copy(struct smb_request *req)
 	}
 
 	p = strrchr_m(name,'/');
-	if (!p) {
+	if (p != NULL) {
+		directory = talloc_strndup(ctx, name, PTR_DIFF(p, name));
+		mask = p+1;
+	} else {
 		directory = talloc_strdup(ctx, "./");
-		if (!directory) {
-			reply_nterror(req, NT_STATUS_NO_MEMORY);
-			END_PROFILE(SMBcopy);
-			return;
-		}
 		mask = name;
-	} else {
-		*p = 0;
-		directory = talloc_strdup(ctx, name);
-		if (!directory) {
-			reply_nterror(req, NT_STATUS_NO_MEMORY);
-			END_PROFILE(SMBcopy);
-			return;
-		}
-		mask = p+1;
+	}
+
+	if (!directory) {
+		reply_nterror(req, NT_STATUS_NO_MEMORY);
+		END_PROFILE(SMBcopy);
+		return;
 	}
 
 	/*
@@ -6353,8 +6349,7 @@ void reply_copy(struct smb_request *req)
 		long offset = 0;
 
 		if (strequal(mask,"????????.???")) {
-			mask[0] = '*';
-			mask[1] = '\0';
+			mask = mask_star;
 		}
 
 		status = check_name(conn, directory);
-- 
cgit 


From 7bdb571ec4eea6689fa08f40be8b4c0133504f50 Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Sat, 1 Nov 2008 17:35:48 +0100
Subject: Remove a bunch of direct inbuf references by adding "buf" to
 smb_request

---
 source3/smbd/reply.c | 93 ++++++++++++++++++++++++----------------------------
 1 file changed, 42 insertions(+), 51 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index bbdf34e3e9..a9c489cef4 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -517,7 +517,7 @@ void reply_tcon(struct smb_request *req)
 	char *dev = NULL;
 	int pwlen=0;
 	NTSTATUS nt_status;
-	char *p;
+	const char *p;
 	DATA_BLOB password_blob;
 	TALLOC_CTX *ctx = talloc_tos();
 
@@ -529,7 +529,7 @@ void reply_tcon(struct smb_request *req)
 		return;
 	}
 
-	p = smb_buf(req->inbuf)+1;
+	p = (const char *)req->buf + 1;
 	p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
 				    &service_buf, p, STR_TERMINATE) + 1;
 	pwlen = srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
@@ -583,7 +583,7 @@ void reply_tcon(struct smb_request *req)
 void reply_tcon_and_X(struct smb_request *req)
 {
 	connection_struct *conn = req->conn;
-	char *service = NULL;
+	const char *service = NULL;
 	DATA_BLOB password;
 	TALLOC_CTX *ctx = talloc_tos();
 	/* what the cleint thinks the device is */
@@ -593,7 +593,7 @@ void reply_tcon_and_X(struct smb_request *req)
 	NTSTATUS nt_status;
 	int passlen;
 	char *path = NULL;
-	char *p, *q;
+	const char *p, *q;
 	uint16 tcon_flags;
 
 	START_PROFILE(SMBtconX);
@@ -621,23 +621,21 @@ void reply_tcon_and_X(struct smb_request *req)
 	}
 
 	if (global_encrypted_passwords_negotiated) {
-		password = data_blob_talloc(talloc_tos(), smb_buf(req->inbuf),
-					    passlen);
+		password = data_blob_talloc(talloc_tos(), req->buf, passlen);
 		if (lp_security() == SEC_SHARE) {
 			/*
 			 * Security = share always has a pad byte
 			 * after the password.
 			 */
-			p = smb_buf(req->inbuf) + passlen + 1;
+			p = (const char *)req->buf + passlen + 1;
 		} else {
-			p = smb_buf(req->inbuf) + passlen;
+			p = (const char *)req->buf + passlen;
 		}
 	} else {
-		password = data_blob_talloc(talloc_tos(), smb_buf(req->inbuf),
-					    passlen+1);
+		password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
 		/* Ensure correct termination */
 		password.data[passlen]=0;
-		p = smb_buf(req->inbuf) + passlen + 1;
+		p = (const char *)req->buf + passlen + 1;
 	}
 
 	p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2, &path, p,
@@ -887,8 +885,7 @@ void reply_checkpath(struct smb_request *req)
 	START_PROFILE(SMBcheckpath);
 
 	srvstr_get_path(ctx,(char *)req->inbuf, req->flags2, &name,
-			smb_buf(req->inbuf) + 1, 0,
-			STR_TERMINATE, &status);
+			(const char *)req->buf + 1, 0, STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		status = map_checkpath_error((char *)req->inbuf, status);
 		reply_nterror(req, status);
@@ -979,13 +976,13 @@ void reply_getatr(struct smb_request *req)
 	int mode=0;
 	SMB_OFF_T size=0;
 	time_t mtime=0;
-	char *p;
+	const char *p;
 	NTSTATUS status;
 	TALLOC_CTX *ctx = talloc_tos();
 
 	START_PROFILE(SMBgetatr);
 
-	p = smb_buf(req->inbuf) + 1;
+	p = (const char *)req->buf + 1;
 	p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
 			     0, STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -1081,7 +1078,7 @@ void reply_setatr(struct smb_request *req)
 	int mode;
 	time_t mtime;
 	SMB_STRUCT_STAT sbuf;
-	char *p;
+	const char *p;
 	NTSTATUS status;
 	TALLOC_CTX *ctx = talloc_tos();
 
@@ -1094,7 +1091,7 @@ void reply_setatr(struct smb_request *req)
 		return;
 	}
 
-	p = smb_buf(req->inbuf) + 1;
+	p = (const char *)req->buf + 1;
 	p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
 				0, STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -1236,7 +1233,7 @@ void reply_dskattr(struct smb_request *req)
 void reply_search(struct smb_request *req)
 {
 	connection_struct *conn = req->conn;
-	char *mask = NULL;
+	const char *mask = NULL;
 	char *directory = NULL;
 	char *fname = NULL;
 	SMB_OFF_T size;
@@ -1246,7 +1243,7 @@ void reply_search(struct smb_request *req)
 	unsigned int numentries = 0;
 	unsigned int maxentries = 0;
 	bool finished = False;
-	char *p;
+	const char *p;
 	int status_len;
 	char *path = NULL;
 	char status[21];
@@ -1281,7 +1278,7 @@ void reply_search(struct smb_request *req)
 	reply_outbuf(req, 1, 3);
 	maxentries = SVAL(req->inbuf,smb_vwv0);
 	dirtype = SVAL(req->inbuf,smb_vwv1);
-	p = smb_buf(req->inbuf) + 1;
+	p = (const char *)req->buf + 1;
 	p += srvstr_get_path_wcard(ctx,
 				(char *)req->inbuf,
 				req->flags2,
@@ -1544,7 +1541,7 @@ void reply_fclose(struct smb_request *req)
 	int status_len;
 	char status[21];
 	int dptr_num= -2;
-	char *p;
+	const char *p;
 	char *path = NULL;
 	NTSTATUS err;
 	bool path_contains_wcard = False;
@@ -1558,7 +1555,7 @@ void reply_fclose(struct smb_request *req)
 		return;
 	}
 
-	p = smb_buf(req->inbuf) + 1;
+	p = (const char *)req->buf + 1;
 	p += srvstr_get_path_wcard(ctx,
 				(char *)req->inbuf,
 				req->flags2,
@@ -1636,8 +1633,7 @@ void reply_open(struct smb_request *req)
 	dos_attr = SVAL(req->inbuf,smb_vwv1);
 
 	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
-			smb_buf(req->inbuf)+1, 0,
-			STR_TERMINATE, &status);
+			(const char *)req->buf+1, 0, STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBopen);
@@ -1781,8 +1777,7 @@ void reply_open_and_X(struct smb_request *req)
 
 	/* XXXX we need to handle passed times, sattr and flags */
 	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
-			smb_buf(req->inbuf), 0, STR_TERMINATE,
-			&status);
+			(const char *)req->buf, 0, STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBopenX);
@@ -1978,8 +1973,7 @@ void reply_mknew(struct smb_request *req)
 			/* mtime. */
 
 	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
-                        smb_buf(req->inbuf) + 1, 0,
-			STR_TERMINATE, &status);
+                        (const char *)req->buf + 1, 0, STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBcreate);
@@ -2084,8 +2078,7 @@ void reply_ctemp(struct smb_request *req)
 	oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
 
 	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
-			smb_buf(req->inbuf)+1, 0, STR_TERMINATE,
-			&status);
+			(const char *)req->buf+1, 0, STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBctemp);
@@ -2555,8 +2548,8 @@ void reply_unlink(struct smb_request *req)
 	dirtype = SVAL(req->inbuf,smb_vwv0);
 
 	srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name,
-			      smb_buf(req->inbuf) + 1, 0,
-			      STR_TERMINATE, &status, &path_contains_wcard);
+			      (const char *)req->buf + 1, 0, STR_TERMINATE,
+			      &status, &path_contains_wcard);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBunlink);
@@ -3642,7 +3635,7 @@ void reply_writeunlock(struct smb_request *req)
 	ssize_t nwritten = -1;
 	size_t numtowrite;
 	SMB_OFF_T startpos;
-	char *data;
+	const char *data;
 	NTSTATUS status = NT_STATUS_OK;
 	files_struct *fsp;
 
@@ -3669,7 +3662,7 @@ void reply_writeunlock(struct smb_request *req)
 
 	numtowrite = SVAL(req->inbuf,smb_vwv1);
 	startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
-	data = smb_buf(req->inbuf) + 3;
+	data = (const char *)req->buf + 3;
 
 	if (numtowrite
 	    && is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtowrite,
@@ -3742,7 +3735,7 @@ void reply_write(struct smb_request *req)
 	size_t numtowrite;
 	ssize_t nwritten = -1;
 	SMB_OFF_T startpos;
-	char *data;
+	const char *data;
 	files_struct *fsp;
 	NTSTATUS status;
 
@@ -3776,7 +3769,7 @@ void reply_write(struct smb_request *req)
 
 	numtowrite = SVAL(req->inbuf,smb_vwv1);
 	startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
-	data = smb_buf(req->inbuf) + 3;
+	data = (const char *)req->buf + 3;
 
 	if (is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtowrite,
 		      (uint64_t)startpos, WRITE_LOCK)) {
@@ -4326,7 +4319,7 @@ void reply_writeclose(struct smb_request *req)
 	ssize_t nwritten = -1;
 	NTSTATUS close_status = NT_STATUS_OK;
 	SMB_OFF_T startpos;
-	char *data;
+	const char *data;
 	struct timespec mtime;
 	files_struct *fsp;
 
@@ -4354,7 +4347,7 @@ void reply_writeclose(struct smb_request *req)
 	startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
 	mtime = convert_time_t_to_timespec(srv_make_unix_date3(
 						   req->inbuf+smb_vwv4));
-	data = smb_buf(req->inbuf) + 1;
+	data = (const char *)req->buf + 1;
 
 	if (numtowrite
 	    && is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtowrite,
@@ -4571,7 +4564,7 @@ void reply_echo(struct smb_request *req)
 
 	/* copy any incoming data back out */
 	if (req->buflen > 0) {
-		memcpy(smb_buf(req->outbuf), smb_buf(req->inbuf), req->buflen);
+		memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
 	}
 
 	if (smb_reverb > 100) {
@@ -4789,7 +4782,7 @@ void reply_printwrite(struct smb_request *req)
 {
 	connection_struct *conn = req->conn;
 	int numtowrite;
-	char *data;
+	const char *data;
 	files_struct *fsp;
 
 	START_PROFILE(SMBsplwr);
@@ -4819,7 +4812,7 @@ void reply_printwrite(struct smb_request *req)
 		return;
 	}
 
-	numtowrite = SVAL(smb_buf(req->inbuf),1);
+	numtowrite = SVAL(req->buf, 1);
 
 	if (req->buflen < numtowrite + 3) {
 		reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -4827,7 +4820,7 @@ void reply_printwrite(struct smb_request *req)
 		return;
 	}
 
-	data = smb_buf(req->inbuf) + 3;
+	data = (const char *)req->buf + 3;
 
 	if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
 		reply_unixerror(req, ERRHRD, ERRdiskfull);
@@ -4856,8 +4849,7 @@ void reply_mkdir(struct smb_request *req)
 	START_PROFILE(SMBmkdir);
 
 	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
-			smb_buf(req->inbuf) + 1, 0,
-			STR_TERMINATE, &status);
+			(const char *)req->buf + 1, 0, STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBmkdir);
@@ -5127,8 +5119,7 @@ void reply_rmdir(struct smb_request *req)
 	START_PROFILE(SMBrmdir);
 
 	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
-			smb_buf(req->inbuf) + 1, 0,
-			STR_TERMINATE, &status);
+			(const char *)req->buf + 1, 0, STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBrmdir);
@@ -5908,7 +5899,7 @@ void reply_mv(struct smb_request *req)
 	connection_struct *conn = req->conn;
 	char *name = NULL;
 	char *newname = NULL;
-	char *p;
+	const char *p;
 	uint32 attrs;
 	NTSTATUS status;
 	bool src_has_wcard = False;
@@ -5925,7 +5916,7 @@ void reply_mv(struct smb_request *req)
 
 	attrs = SVAL(req->inbuf,smb_vwv0);
 
-	p = smb_buf(req->inbuf) + 1;
+	p = (const char *)req->buf + 1;
 	p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
 				   0, STR_TERMINATE, &status,
 				   &src_has_wcard);
@@ -6169,7 +6160,7 @@ void reply_copy(struct smb_request *req)
 	ofun = SVAL(req->inbuf,smb_vwv1);
 	flags = SVAL(req->inbuf,smb_vwv2);
 
-	p = smb_buf(req->inbuf);
+	p = (const char *)req->buf;
 	p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
 				   0, STR_TERMINATE, &status,
 				   &source_has_wild);
@@ -6613,7 +6604,7 @@ void reply_lockingX(struct smb_request *req)
 	uint32 lock_pid;
 	int32 lock_timeout;
 	int i;
-	char *data;
+	const uint8_t *data;
 	bool large_file_format;
 	bool err;
 	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
@@ -6639,7 +6630,7 @@ void reply_lockingX(struct smb_request *req)
 		return;
 	}
 
-	data = smb_buf(req->inbuf);
+	data = req->buf;
 
 	if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
 		/* we don't support these - and CANCEL_LOCK makes w2k
-- 
cgit 


From 2bd5ac86ffc9f7610b0205092e4cc9cdccb4752f Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Sun, 2 Nov 2008 00:59:03 +0100
Subject: Add srvstr_get_path_req[_wcard]

---
 source3/smbd/reply.c | 160 +++++++++++++++++----------------------------------
 1 file changed, 53 insertions(+), 107 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index a9c489cef4..ba73f4eccb 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -221,22 +221,8 @@ size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 
 	*pp_dest = NULL;
 
-	if (src_len == 0) {
-		ret = srvstr_pull_buf_talloc(ctx,
-				inbuf,
-				smb_flags2,
-				pp_dest,
-				src,
-				flags);
-	} else {
-		ret = srvstr_pull_talloc(ctx,
-				inbuf,
-				smb_flags2,
-				pp_dest,
-				src,
-				src_len,
-				flags);
-	}
+	ret = srvstr_pull_talloc(ctx, inbuf, smb_flags2, pp_dest, src, src_len,
+				 flags);
 
 	if (!*pp_dest) {
 		*err = NT_STATUS_INVALID_PARAMETER;
@@ -276,48 +262,27 @@ size_t srvstr_get_path(TALLOC_CTX *ctx,
 			int flags,
 			NTSTATUS *err)
 {
-	size_t ret;
-
-	*pp_dest = NULL;
-
-	if (src_len == 0) {
-		ret = srvstr_pull_buf_talloc(ctx,
-					inbuf,
-					smb_flags2,
-					pp_dest,
-					src,
-					flags);
-	} else {
-		ret = srvstr_pull_talloc(ctx,
-				inbuf,
-				smb_flags2,
-				pp_dest,
-				src,
-				src_len,
-				flags);
-	}
-
-	if (!*pp_dest) {
-		*err = NT_STATUS_INVALID_PARAMETER;
-		return ret;
-	}
-
-	if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
-		/*
-		 * For a DFS path the function parse_dfs_path()
-		 * will do the path processing, just make a copy.
-		 */
-		*err = NT_STATUS_OK;
-		return ret;
-	}
+	bool ignore;
+	return srvstr_get_path_wcard(ctx, inbuf, smb_flags2, pp_dest, src,
+				     src_len, flags, err, &ignore);
+}
 
-	if (lp_posix_pathnames()) {
-		*err = check_path_syntax_posix(*pp_dest);
-	} else {
-		*err = check_path_syntax(*pp_dest);
-	}
+size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
+				 char **pp_dest, const char *src, int flags,
+				 NTSTATUS *err, bool *contains_wcard)
+{
+	return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
+				     pp_dest, src, smb_bufrem(req->inbuf, src),
+				     flags, err, contains_wcard);
+}
 
-	return ret;
+size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
+			   char **pp_dest, const char *src, int flags,
+			   NTSTATUS *err)
+{
+	bool ignore;
+	return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
+					 flags, err, &ignore);
 }
 
 /****************************************************************************
@@ -884,8 +849,9 @@ void reply_checkpath(struct smb_request *req)
 
 	START_PROFILE(SMBcheckpath);
 
-	srvstr_get_path(ctx,(char *)req->inbuf, req->flags2, &name,
-			(const char *)req->buf + 1, 0, STR_TERMINATE, &status);
+	srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
+			    STR_TERMINATE, &status);
+
 	if (!NT_STATUS_IS_OK(status)) {
 		status = map_checkpath_error((char *)req->inbuf, status);
 		reply_nterror(req, status);
@@ -983,8 +949,7 @@ void reply_getatr(struct smb_request *req)
 	START_PROFILE(SMBgetatr);
 
 	p = (const char *)req->buf + 1;
-	p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
-			     0, STR_TERMINATE, &status);
+	p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBgetatr);
@@ -1092,8 +1057,7 @@ void reply_setatr(struct smb_request *req)
 	}
 
 	p = (const char *)req->buf + 1;
-	p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
-				0, STR_TERMINATE, &status);
+	p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBsetatr);
@@ -1279,15 +1243,8 @@ void reply_search(struct smb_request *req)
 	maxentries = SVAL(req->inbuf,smb_vwv0);
 	dirtype = SVAL(req->inbuf,smb_vwv1);
 	p = (const char *)req->buf + 1;
-	p += srvstr_get_path_wcard(ctx,
-				(char *)req->inbuf,
-				req->flags2,
-				&path,
-				p,
-				0,
-				STR_TERMINATE,
-				&nt_status,
-				&mask_contains_wcard);
+	p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
+				       &nt_status, &mask_contains_wcard);
 	if (!NT_STATUS_IS_OK(nt_status)) {
 		reply_nterror(req, nt_status);
 		END_PROFILE(SMBsearch);
@@ -1556,15 +1513,8 @@ void reply_fclose(struct smb_request *req)
 	}
 
 	p = (const char *)req->buf + 1;
-	p += srvstr_get_path_wcard(ctx,
-				(char *)req->inbuf,
-				req->flags2,
-				&path,
-				p,
-				0,
-				STR_TERMINATE,
-				&err,
-				&path_contains_wcard);
+	p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
+				       &err, &path_contains_wcard);
 	if (!NT_STATUS_IS_OK(err)) {
 		reply_nterror(req, err);
 		END_PROFILE(SMBfclose);
@@ -1632,8 +1582,8 @@ void reply_open(struct smb_request *req)
 	deny_mode = SVAL(req->inbuf,smb_vwv0);
 	dos_attr = SVAL(req->inbuf,smb_vwv1);
 
-	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
-			(const char *)req->buf+1, 0, STR_TERMINATE, &status);
+	srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
+			    STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBopen);
@@ -1776,8 +1726,8 @@ void reply_open_and_X(struct smb_request *req)
 	}
 
 	/* XXXX we need to handle passed times, sattr and flags */
-	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
-			(const char *)req->buf, 0, STR_TERMINATE, &status);
+	srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
+			STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBopenX);
@@ -1972,8 +1922,8 @@ void reply_mknew(struct smb_request *req)
 			srv_make_unix_date3(req->inbuf + smb_vwv1));
 			/* mtime. */
 
-	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
-                        (const char *)req->buf + 1, 0, STR_TERMINATE, &status);
+	srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
+			    STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBcreate);
@@ -2077,8 +2027,8 @@ void reply_ctemp(struct smb_request *req)
 	fattr = SVAL(req->inbuf,smb_vwv0);
 	oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
 
-	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
-			(const char *)req->buf+1, 0, STR_TERMINATE, &status);
+	srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
+			    STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBctemp);
@@ -2547,9 +2497,9 @@ void reply_unlink(struct smb_request *req)
 
 	dirtype = SVAL(req->inbuf,smb_vwv0);
 
-	srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name,
-			      (const char *)req->buf + 1, 0, STR_TERMINATE,
-			      &status, &path_contains_wcard);
+	srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
+				  STR_TERMINATE, &status,
+				  &path_contains_wcard);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBunlink);
@@ -4848,8 +4798,8 @@ void reply_mkdir(struct smb_request *req)
 
 	START_PROFILE(SMBmkdir);
 
-	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
-			(const char *)req->buf + 1, 0, STR_TERMINATE, &status);
+	srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
+			    STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBmkdir);
@@ -5118,8 +5068,8 @@ void reply_rmdir(struct smb_request *req)
 
 	START_PROFILE(SMBrmdir);
 
-	srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
-			(const char *)req->buf + 1, 0, STR_TERMINATE, &status);
+	srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
+			    STR_TERMINATE, &status);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBrmdir);
@@ -5917,18 +5867,16 @@ void reply_mv(struct smb_request *req)
 	attrs = SVAL(req->inbuf,smb_vwv0);
 
 	p = (const char *)req->buf + 1;
-	p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
-				   0, STR_TERMINATE, &status,
-				   &src_has_wcard);
+	p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
+				       &status, &src_has_wcard);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBmv);
 		return;
 	}
 	p++;
-	p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
-				   0, STR_TERMINATE, &status,
-				   &dest_has_wcard);
+	p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
+				       &status, &dest_has_wcard);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBmv);
@@ -6161,17 +6109,15 @@ void reply_copy(struct smb_request *req)
 	flags = SVAL(req->inbuf,smb_vwv2);
 
 	p = (const char *)req->buf;
-	p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
-				   0, STR_TERMINATE, &status,
-				   &source_has_wild);
+	p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
+				       &status, &source_has_wild);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBcopy);
 		return;
 	}
-	p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
-				   0, STR_TERMINATE, &status,
-				   &dest_has_wild);
+	p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
+				       &status, &dest_has_wild);
 	if (!NT_STATUS_IS_OK(status)) {
 		reply_nterror(req, status);
 		END_PROFILE(SMBcopy);
-- 
cgit 


From a31fab81568ed2b4314ea05740423aceb5d7c977 Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Sun, 2 Nov 2008 01:07:46 +0100
Subject: Simplify params of srvstr_pull_buf_talloc()

Now that "req" is available everywhere, use it. Rename srvstr_pull_buf_talloc()
to srvstr_pull_req()
---
 source3/smbd/reply.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index ba73f4eccb..f7165ff217 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -495,13 +495,12 @@ void reply_tcon(struct smb_request *req)
 	}
 
 	p = (const char *)req->buf + 1;
-	p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
-				    &service_buf, p, STR_TERMINATE) + 1;
-	pwlen = srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
-				       &password, p, STR_TERMINATE) + 1;
-	p += pwlen;
-	p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
-				    &dev, p, STR_TERMINATE) + 1;
+	p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
+	p += 1;
+	pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
+	p += pwlen+1;
+	p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
+	p += 1;
 
 	if (service_buf == NULL || password == NULL || dev == NULL) {
 		reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
@@ -603,8 +602,7 @@ void reply_tcon_and_X(struct smb_request *req)
 		p = (const char *)req->buf + passlen + 1;
 	}
 
-	p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2, &path, p,
-			     STR_TERMINATE);
+	p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 
 	if (path == NULL) {
 		data_blob_clear_free(&password);
-- 
cgit 


From af7cf4f992d8bb3b6677c094c85b9b1055a6ffc9 Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Sun, 2 Nov 2008 01:21:53 +0100
Subject: Remove some direct inbuf references by adding smbreq_bufrem

---
 source3/smbd/reply.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index f7165ff217..ebd85bcd28 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -272,7 +272,7 @@ size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 				 NTSTATUS *err, bool *contains_wcard)
 {
 	return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
-				     pp_dest, src, smb_bufrem(req->inbuf, src),
+				     pp_dest, src, smbreq_bufrem(req, src),
 				     flags, err, contains_wcard);
 }
 
@@ -630,7 +630,7 @@ void reply_tcon_and_X(struct smb_request *req)
 
 	p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 				&client_devicetype, p,
-				MIN(6,smb_bufrem(req->inbuf, p)), STR_ASCII);
+				MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 
 	if (client_devicetype == NULL) {
 		data_blob_clear_free(&password);
-- 
cgit 


From e48364af2f53436e1110bb942665a2fa19a26322 Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Sun, 2 Nov 2008 01:27:41 +0100
Subject: Rename "inbuf" to "base_ptr" in srvstr_get_path_*

---
 source3/smbd/reply.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index ebd85bcd28..c7722804b3 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -208,7 +208,7 @@ NTSTATUS check_path_syntax_posix(char *path)
 ****************************************************************************/
 
 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
-			const char *inbuf,
+			const char *base_ptr,
 			uint16 smb_flags2,
 			char **pp_dest,
 			const char *src,
@@ -221,8 +221,8 @@ size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 
 	*pp_dest = NULL;
 
-	ret = srvstr_pull_talloc(ctx, inbuf, smb_flags2, pp_dest, src, src_len,
-				 flags);
+	ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
+				 src_len, flags);
 
 	if (!*pp_dest) {
 		*err = NT_STATUS_INVALID_PARAMETER;
@@ -254,7 +254,7 @@ size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 ****************************************************************************/
 
 size_t srvstr_get_path(TALLOC_CTX *ctx,
-			const char *inbuf,
+			const char *base_ptr,
 			uint16 smb_flags2,
 			char **pp_dest,
 			const char *src,
@@ -263,7 +263,7 @@ size_t srvstr_get_path(TALLOC_CTX *ctx,
 			NTSTATUS *err)
 {
 	bool ignore;
-	return srvstr_get_path_wcard(ctx, inbuf, smb_flags2, pp_dest, src,
+	return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 				     src_len, flags, err, &ignore);
 }
 
-- 
cgit 


From 2bab73a18d22284c68fefb091c3c6869898ef576 Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Sun, 2 Nov 2008 12:20:47 +0100
Subject: Remove a bunch of direct inbuf references by adding "vwv" to
 smb_request

---
 source3/smbd/reply.c | 215 +++++++++++++++++++++++++--------------------------
 1 file changed, 106 insertions(+), 109 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index c7722804b3..2aa3c1b841 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -568,8 +568,8 @@ void reply_tcon_and_X(struct smb_request *req)
 		return;
 	}
 
-	passlen = SVAL(req->inbuf,smb_vwv3);
-	tcon_flags = SVAL(req->inbuf,smb_vwv2);
+	passlen = SVAL(req->vwv+3, 0);
+	tcon_flags = SVAL(req->vwv+2, 0);
 
 	/* we might have to close an old one */
 	if ((tcon_flags & 0x1) && conn) {
@@ -764,8 +764,8 @@ void reply_ioctl(struct smb_request *req)
 		return;
 	}
 
-	device     = SVAL(req->inbuf,smb_vwv1);
-	function   = SVAL(req->inbuf,smb_vwv2);
+	device     = SVAL(req->vwv+1, 0);
+	function   = SVAL(req->vwv+2, 0);
 	ioctl_code = (device << 16) + function;
 
 	DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
@@ -792,7 +792,7 @@ void reply_ioctl(struct smb_request *req)
 		case IOCTL_QUERY_JOB_INFO:		    
 		{
 			files_struct *fsp = file_fsp(
-				req, SVAL(req->inbuf, smb_vwv0));
+				req, SVAL(req->vwv+0, 0));
 			if (!fsp) {
 				reply_doserror(req, ERRDOS, ERRbadfid);
 				END_PROFILE(SMBioctl);
@@ -871,7 +871,7 @@ void reply_checkpath(struct smb_request *req)
 		goto path_err;
 	}
 
-	DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->inbuf,smb_vwv0)));
+	DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
 
 	status = unix_convert(ctx, conn, name, False, &name, NULL, &sbuf);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -1102,8 +1102,8 @@ void reply_setatr(struct smb_request *req)
 		return;
 	}
 
-	mode = SVAL(req->inbuf,smb_vwv0);
-	mtime = srv_make_unix_date3(req->inbuf+smb_vwv1);
+	mode = SVAL(req->vwv+0, 0);
+	mtime = srv_make_unix_date3(req->vwv+1);
 
 	ts[1] = convert_time_t_to_timespec(mtime);
 	status = smb_set_file_time(conn, NULL, fname,
@@ -1238,8 +1238,8 @@ void reply_search(struct smb_request *req)
 	}
 
 	reply_outbuf(req, 1, 3);
-	maxentries = SVAL(req->inbuf,smb_vwv0);
-	dirtype = SVAL(req->inbuf,smb_vwv1);
+	maxentries = SVAL(req->vwv+0, 0);
+	dirtype = SVAL(req->vwv+1, 0);
 	p = (const char *)req->buf + 1;
 	p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
 				       &nt_status, &mask_contains_wcard);
@@ -1577,8 +1577,8 @@ void reply_open(struct smb_request *req)
 	}
 
 	oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
-	deny_mode = SVAL(req->inbuf,smb_vwv0);
-	dos_attr = SVAL(req->inbuf,smb_vwv1);
+	deny_mode = SVAL(req->vwv+0, 0);
+	dos_attr = SVAL(req->vwv+1, 0);
 
 	srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
 			    STR_TERMINATE, &status);
@@ -1677,8 +1677,8 @@ void reply_open_and_X(struct smb_request *req)
 	int core_oplock_request;
 	int oplock_request;
 #if 0
-	int smb_sattr = SVAL(req->inbuf,smb_vwv4);
-	uint32 smb_time = make_unix_date3(req->inbuf+smb_vwv6);
+	int smb_sattr = SVAL(req->vwv+4, 0);
+	uint32 smb_time = make_unix_date3(req->vwv+6);
 #endif
 	int smb_ofun;
 	uint32 fattr=0;
@@ -1703,14 +1703,14 @@ void reply_open_and_X(struct smb_request *req)
 		return;
 	}
 
-	open_flags = SVAL(req->inbuf,smb_vwv2);
-	deny_mode = SVAL(req->inbuf,smb_vwv3);
-	smb_attr = SVAL(req->inbuf,smb_vwv5);
+	open_flags = SVAL(req->vwv+2, 0);
+	deny_mode = SVAL(req->vwv+3, 0);
+	smb_attr = SVAL(req->vwv+5, 0);
 	ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
 	core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
 	oplock_request = ex_oplock_request | core_oplock_request;
-	smb_ofun = SVAL(req->inbuf,smb_vwv8);
-	allocation_size = (uint64_t)IVAL(req->inbuf,smb_vwv9);
+	smb_ofun = SVAL(req->vwv+8, 0);
+	allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
 
 	/* If it's an IPC, pass off the pipe handler. */
 	if (IS_IPC(conn)) {
@@ -1912,12 +1912,11 @@ void reply_mknew(struct smb_request *req)
 		return;
 	}
 
-	fattr = SVAL(req->inbuf,smb_vwv0);
+	fattr = SVAL(req->vwv+0, 0);
 	oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
 	com = SVAL(req->inbuf,smb_com);
 
-	ts[1] =convert_time_t_to_timespec(
-			srv_make_unix_date3(req->inbuf + smb_vwv1));
+	ts[1] = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
 			/* mtime. */
 
 	srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
@@ -2022,7 +2021,7 @@ void reply_ctemp(struct smb_request *req)
 		return;
 	}
 
-	fattr = SVAL(req->inbuf,smb_vwv0);
+	fattr = SVAL(req->vwv+0, 0);
 	oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
 
 	srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
@@ -2493,7 +2492,7 @@ void reply_unlink(struct smb_request *req)
 		return;
 	}
 
-	dirtype = SVAL(req->inbuf,smb_vwv0);
+	dirtype = SVAL(req->vwv+0, 0);
 
 	srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
 				  STR_TERMINATE, &status,
@@ -2748,7 +2747,7 @@ void reply_readbraw(struct smb_request *req)
 	 * return a zero length response here.
 	 */
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	/*
 	 * We have to do a check_fsp by hand here, as
@@ -2764,7 +2763,7 @@ void reply_readbraw(struct smb_request *req)
 		 */
 		DEBUG(3,("reply_readbraw: fnum %d not valid "
 			"- cache prime?\n",
-			(int)SVAL(req->inbuf,smb_vwv0)));
+			(int)SVAL(req->vwv+0, 0)));
 		reply_readbraw_error();
 		END_PROFILE(SMBreadbraw);
 		return;
@@ -2775,7 +2774,7 @@ void reply_readbraw(struct smb_request *req)
 			((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
 				(fsp->access_mask & FILE_EXECUTE)))) {
 		DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
-				(int)SVAL(req->inbuf,smb_vwv0)));
+				(int)SVAL(req->vwv+0, 0)));
 		reply_readbraw_error();
 		END_PROFILE(SMBreadbraw);
 		return;
@@ -2783,14 +2782,14 @@ void reply_readbraw(struct smb_request *req)
 
 	flush_write_cache(fsp, READRAW_FLUSH);
 
-	startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv1);
+	startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
 	if(req->wct == 10) {
 		/*
 		 * This is a large offset (64 bit) read.
 		 */
 #ifdef LARGE_SMB_OFF_T
 
-		startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv8)) << 32);
+		startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
 
 #else /* !LARGE_SMB_OFF_T */
 
@@ -2798,11 +2797,11 @@ void reply_readbraw(struct smb_request *req)
 		 * Ensure we haven't been sent a >32 bit offset.
 		 */
 
-		if(IVAL(req->inbuf,smb_vwv8) != 0) {
+		if(IVAL(req->vwv+8, 0) != 0) {
 			DEBUG(0,("reply_readbraw: large offset "
 				"(%x << 32) used and we don't support "
 				"64 bit offsets.\n",
-			(unsigned int)IVAL(req->inbuf,smb_vwv8) ));
+			(unsigned int)IVAL(req->vwv+8, 0) ));
 			reply_readbraw_error();
 			END_PROFILE(SMBreadbraw);
 			return;
@@ -2820,8 +2819,8 @@ void reply_readbraw(struct smb_request *req)
 		}      
 	}
 
-	maxcount = (SVAL(req->inbuf,smb_vwv3) & 0xFFFF);
-	mincount = (SVAL(req->inbuf,smb_vwv4) & 0xFFFF);
+	maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
+	mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
 
 	/* ensure we don't overrun the packet size */
 	maxcount = MIN(65535,maxcount);
@@ -2890,7 +2889,7 @@ void reply_lockread(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	if (!check_fsp(conn, req, fsp)) {
 		END_PROFILE(SMBlockread);
@@ -2905,8 +2904,8 @@ void reply_lockread(struct smb_request *req)
 
 	release_level_2_oplocks_on_change(fsp);
 
-	numtoread = SVAL(req->inbuf,smb_vwv1);
-	startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
+	numtoread = SVAL(req->vwv+1, 0);
+	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
 
 	numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
 
@@ -2998,7 +2997,7 @@ void reply_read(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	if (!check_fsp(conn, req, fsp)) {
 		END_PROFILE(SMBread);
@@ -3011,8 +3010,8 @@ void reply_read(struct smb_request *req)
 		return;
 	}
 
-	numtoread = SVAL(req->inbuf,smb_vwv1);
-	startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
+	numtoread = SVAL(req->vwv+1, 0);
+	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
 
 	numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
 
@@ -3118,7 +3117,7 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
 	 * on a train in Germany :-). JRA.
 	 */
 
-	if ((chain_size == 0) && (CVAL(req->inbuf,smb_vwv0) == 0xFF) &&
+	if ((chain_size == 0) && (CVAL(req->vwv+0, 0) == 0xFF) &&
 	    !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
 	    lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
 		uint8 headerbuf[smb_size + 12 * 2];
@@ -3232,7 +3231,7 @@ void reply_read_and_X(struct smb_request *req)
 	size_t smb_maxcnt;
 	bool big_readX = False;
 #if 0
-	size_t smb_mincnt = SVAL(req->inbuf,smb_vwv6);
+	size_t smb_mincnt = SVAL(req->vwv+6, 0);
 #endif
 
 	START_PROFILE(SMBreadX);
@@ -3242,9 +3241,9 @@ void reply_read_and_X(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv2));
-	startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
-	smb_maxcnt = SVAL(req->inbuf,smb_vwv5);
+	fsp = file_fsp(req, SVAL(req->vwv+2, 0));
+	startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
+	smb_maxcnt = SVAL(req->vwv+5, 0);
 
 	/* If it's an IPC, pass off the pipe handler. */
 	if (IS_IPC(conn)) {
@@ -3265,11 +3264,11 @@ void reply_read_and_X(struct smb_request *req)
 	}
 
 	if (global_client_caps & CAP_LARGE_READX) {
-		size_t upper_size = SVAL(req->inbuf,smb_vwv7);
+		size_t upper_size = SVAL(req->vwv+7, 0);
 		smb_maxcnt |= (upper_size<<16);
 		if (upper_size > 1) {
 			/* Can't do this on a chained packet. */
-			if ((CVAL(req->inbuf,smb_vwv0) != 0xFF)) {
+			if ((CVAL(req->vwv+0, 0) != 0xFF)) {
 				reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
 				END_PROFILE(SMBreadX);
 				return;
@@ -3296,7 +3295,7 @@ void reply_read_and_X(struct smb_request *req)
 		/*
 		 * This is a large offset (64 bit) read.
 		 */
-		startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv10)) << 32);
+		startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
 
 #else /* !LARGE_SMB_OFF_T */
 
@@ -3304,10 +3303,10 @@ void reply_read_and_X(struct smb_request *req)
 		 * Ensure we haven't been sent a >32 bit offset.
 		 */
 
-		if(IVAL(req->inbuf,smb_vwv10) != 0) {
+		if(IVAL(req->vwv+10, 0) != 0) {
 			DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
 				 "used and we don't support 64 bit offsets.\n",
-				 (unsigned int)IVAL(req->inbuf,smb_vwv10) ));
+				 (unsigned int)IVAL(req->vwv+10, 0) ));
 			END_PROFILE(SMBreadX);
 			reply_doserror(req, ERRDOS, ERRbadaccess);
 			return;
@@ -3390,7 +3389,7 @@ void reply_writebraw(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 	if (!check_fsp(conn, req, fsp)) {
 		error_to_writebrawerr(req);
 		END_PROFILE(SMBwritebraw);
@@ -3404,9 +3403,9 @@ void reply_writebraw(struct smb_request *req)
 		return;
 	}
 
-	tcount = IVAL(req->inbuf,smb_vwv1);
-	startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
-	write_through = BITSETW(req->inbuf+smb_vwv7,0);
+	tcount = IVAL(req->vwv+1, 0);
+	startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
+	write_through = BITSETW(req->vwv+7,0);
 
 	/* We have to deal with slightly different formats depending
 		on whether we are using the core+ or lanman1.0 protocol */
@@ -3415,8 +3414,8 @@ void reply_writebraw(struct smb_request *req)
 		numtowrite = SVAL(smb_buf(req->inbuf),-2);
 		data = smb_buf(req->inbuf);
 	} else {
-		numtowrite = SVAL(req->inbuf,smb_vwv10);
-		data = smb_base(req->inbuf) + SVAL(req->inbuf, smb_vwv11);
+		numtowrite = SVAL(req->vwv+10, 0);
+		data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
 	}
 
 	/* Ensure we don't write bytes past the end of this packet. */
@@ -3595,7 +3594,7 @@ void reply_writeunlock(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	if (!check_fsp(conn, req, fsp)) {
 		END_PROFILE(SMBwriteunlock);
@@ -3608,8 +3607,8 @@ void reply_writeunlock(struct smb_request *req)
 		return;
 	}
 
-	numtowrite = SVAL(req->inbuf,smb_vwv1);
-	startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
+	numtowrite = SVAL(req->vwv+1, 0);
+	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
 	data = (const char *)req->buf + 3;
 
 	if (numtowrite
@@ -3702,7 +3701,7 @@ void reply_write(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	if (!check_fsp(conn, req, fsp)) {
 		END_PROFILE(SMBwrite);
@@ -3715,8 +3714,8 @@ void reply_write(struct smb_request *req)
 		return;
 	}
 
-	numtowrite = SVAL(req->inbuf,smb_vwv1);
-	startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
+	numtowrite = SVAL(req->vwv+1, 0);
+	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
 	data = (const char *)req->buf + 3;
 
 	if (is_locked(fsp, (uint32)req->smbpid, (uint64_t)numtowrite,
@@ -3889,14 +3888,14 @@ void reply_write_and_X(struct smb_request *req)
 		return;
 	}
 
-	numtowrite = SVAL(req->inbuf,smb_vwv10);
-	smb_doff = SVAL(req->inbuf,smb_vwv11);
+	numtowrite = SVAL(req->vwv+10, 0);
+	smb_doff = SVAL(req->vwv+11, 0);
 	smblen = smb_len(req->inbuf);
 
 	if (req->unread_bytes > 0xFFFF ||
 			(smblen > smb_doff &&
 				smblen - smb_doff > 0xFFFF)) {
-		numtowrite |= (((size_t)SVAL(req->inbuf,smb_vwv9))<<16);
+		numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
 	}
 
 	if (req->unread_bytes) {
@@ -3932,9 +3931,9 @@ void reply_write_and_X(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv2));
-	startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
-	write_through = BITSETW(req->inbuf+smb_vwv7,0);
+	fsp = file_fsp(req, SVAL(req->vwv+2, 0));
+	startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
+	write_through = BITSETW(req->vwv+7,0);
 
 	if (!check_fsp(conn, req, fsp)) {
 		END_PROFILE(SMBwriteX);
@@ -3954,7 +3953,7 @@ void reply_write_and_X(struct smb_request *req)
 		/*
 		 * This is a large offset (64 bit) write.
 		 */
-		startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv12)) << 32);
+		startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
 
 #else /* !LARGE_SMB_OFF_T */
 
@@ -3962,10 +3961,10 @@ void reply_write_and_X(struct smb_request *req)
 		 * Ensure we haven't been sent a >32 bit offset.
 		 */
 
-		if(IVAL(req->inbuf,smb_vwv12) != 0) {
+		if(IVAL(req->vwv+12, 0) != 0) {
 			DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
 				 "used and we don't support 64 bit offsets.\n",
-				 (unsigned int)IVAL(req->inbuf,smb_vwv12) ));
+				 (unsigned int)IVAL(req->vwv+12, 0) ));
 			reply_doserror(req, ERRDOS, ERRbadaccess);
 			END_PROFILE(SMBwriteX);
 			return;
@@ -4053,7 +4052,7 @@ void reply_lseek(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	if (!check_fsp(conn, req, fsp)) {
 		return;
@@ -4061,9 +4060,9 @@ void reply_lseek(struct smb_request *req)
 
 	flush_write_cache(fsp, SEEK_FLUSH);
 
-	mode = SVAL(req->inbuf,smb_vwv1) & 3;
+	mode = SVAL(req->vwv+1, 0) & 3;
 	/* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
-	startpos = (SMB_OFF_T)IVALS(req->inbuf,smb_vwv2);
+	startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
 
 	switch (mode) {
 		case 0:
@@ -4138,7 +4137,7 @@ void reply_flush(struct smb_request *req)
 		return;
 	}
 
-	fnum = SVAL(req->inbuf,smb_vwv0);
+	fnum = SVAL(req->vwv+0, 0);
 	fsp = file_fsp(req, fnum);
 
 	if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
@@ -4201,7 +4200,7 @@ void reply_close(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	/*
 	 * We can only use check_fsp if we know it's not a directory.
@@ -4233,7 +4232,7 @@ void reply_close(struct smb_request *req)
 		 * Take care of any time sent in the close.
 		 */
 
-		t = srv_make_unix_date3(req->inbuf+smb_vwv1);
+		t = srv_make_unix_date3(req->vwv+1);
 		set_close_write_time(fsp, convert_time_t_to_timespec(t));
 
 		/*
@@ -4279,7 +4278,7 @@ void reply_writeclose(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	if (!check_fsp(conn, req, fsp)) {
 		END_PROFILE(SMBwriteclose);
@@ -4291,10 +4290,9 @@ void reply_writeclose(struct smb_request *req)
 		return;
 	}
 
-	numtowrite = SVAL(req->inbuf,smb_vwv1);
-	startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
-	mtime = convert_time_t_to_timespec(srv_make_unix_date3(
-						   req->inbuf+smb_vwv4));
+	numtowrite = SVAL(req->vwv+1, 0);
+	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
+	mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
 	data = (const char *)req->buf + 1;
 
 	if (numtowrite
@@ -4366,7 +4364,7 @@ void reply_lock(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	if (!check_fsp(conn, req, fsp)) {
 		END_PROFILE(SMBlock);
@@ -4375,8 +4373,8 @@ void reply_lock(struct smb_request *req)
 
 	release_level_2_oplocks_on_change(fsp);
 
-	count = (uint64_t)IVAL(req->inbuf,smb_vwv1);
-	offset = (uint64_t)IVAL(req->inbuf,smb_vwv3);
+	count = (uint64_t)IVAL(req->vwv+1, 0);
+	offset = (uint64_t)IVAL(req->vwv+3, 0);
 
 	DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
 		 fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
@@ -4425,15 +4423,15 @@ void reply_unlock(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	if (!check_fsp(conn, req, fsp)) {
 		END_PROFILE(SMBunlock);
 		return;
 	}
 
-	count = (uint64_t)IVAL(req->inbuf,smb_vwv1);
-	offset = (uint64_t)IVAL(req->inbuf,smb_vwv3);
+	count = (uint64_t)IVAL(req->vwv+1, 0);
+	offset = (uint64_t)IVAL(req->vwv+3, 0);
 
 	status = do_unlock(smbd_messaging_context(),
 			fsp,
@@ -4506,7 +4504,7 @@ void reply_echo(struct smb_request *req)
 		return;
 	}
 
-	smb_reverb = SVAL(req->inbuf,smb_vwv0);
+	smb_reverb = SVAL(req->vwv+0, 0);
 
 	reply_outbuf(req, 1, req->buflen);
 
@@ -4599,7 +4597,7 @@ void reply_printclose(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	if (!check_fsp(conn, req, fsp)) {
 		END_PROFILE(SMBsplclose);
@@ -4647,8 +4645,8 @@ void reply_printqueue(struct smb_request *req)
 		return;
 	}
 
-	max_count = SVAL(req->inbuf,smb_vwv0);
-	start_index = SVAL(req->inbuf,smb_vwv1);
+	max_count = SVAL(req->vwv+0, 0);
+	start_index = SVAL(req->vwv+1, 0);
 
 	/* we used to allow the client to get the cnum wrong, but that
 	   is really quite gross and only worked when there was only
@@ -4741,7 +4739,7 @@ void reply_printwrite(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	if (!check_fsp(conn, req, fsp)) {
 		END_PROFILE(SMBsplwr);
@@ -5862,7 +5860,7 @@ void reply_mv(struct smb_request *req)
 		return;
 	}
 
-	attrs = SVAL(req->inbuf,smb_vwv0);
+	attrs = SVAL(req->vwv+0, 0);
 
 	p = (const char *)req->buf + 1;
 	p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
@@ -6102,9 +6100,9 @@ void reply_copy(struct smb_request *req)
 		return;
 	}
 
-	tid2 = SVAL(req->inbuf,smb_vwv0);
-	ofun = SVAL(req->inbuf,smb_vwv1);
-	flags = SVAL(req->inbuf,smb_vwv2);
+	tid2 = SVAL(req->vwv+0, 0);
+	ofun = SVAL(req->vwv+1, 0);
+	flags = SVAL(req->vwv+2, 0);
 
 	p = (const char *)req->buf;
 	p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
@@ -6561,12 +6559,12 @@ void reply_lockingX(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv2));
-	locktype = CVAL(req->inbuf,smb_vwv3);
-	oplocklevel = CVAL(req->inbuf,smb_vwv3+1);
-	num_ulocks = SVAL(req->inbuf,smb_vwv6);
-	num_locks = SVAL(req->inbuf,smb_vwv7);
-	lock_timeout = IVAL(req->inbuf,smb_vwv4);
+	fsp = file_fsp(req, SVAL(req->vwv+2, 0));
+	locktype = CVAL(req->vwv+3, 0);
+	oplocklevel = CVAL(req->vwv+3, 1);
+	num_ulocks = SVAL(req->vwv+6, 0);
+	num_locks = SVAL(req->vwv+7, 0);
+	lock_timeout = IVAL(req->vwv+4, 0);
 	large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
 
 	if (!check_fsp(conn, req, fsp)) {
@@ -6648,11 +6646,10 @@ void reply_lockingX(struct smb_request *req)
 		if (num_locks == 0 && num_ulocks == 0) {
 			/* Sanity check - ensure a pure oplock break is not a
 			   chained request. */
-			if(CVAL(req->inbuf,smb_vwv0) != 0xff)
+			if(CVAL(req->vwv+0, 0) != 0xff)
 				DEBUG(0,("reply_lockingX: Error : pure oplock "
 					 "break is a chained %d request !\n",
-					 (unsigned int)CVAL(req->inbuf,
-							    smb_vwv0) ));
+					 (unsigned int)CVAL(req->vwv+0, 0)));
 			END_PROFILE(SMBlockingX);
 			return;
 		}
@@ -6937,7 +6934,7 @@ void reply_setattrE(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	if(!fsp || (fsp->conn != conn)) {
 		reply_doserror(req, ERRDOS, ERRbadfid);
@@ -6952,9 +6949,9 @@ void reply_setattrE(struct smb_request *req)
 	 */
 
 	ts[0] = convert_time_t_to_timespec(
-		srv_make_unix_date2(req->inbuf+smb_vwv3)); /* atime. */
+		srv_make_unix_date2(req->vwv+3)); /* atime. */
 	ts[1] = convert_time_t_to_timespec(
-		srv_make_unix_date2(req->inbuf+smb_vwv5)); /* mtime. */
+		srv_make_unix_date2(req->vwv+5)); /* mtime. */
 
 	reply_outbuf(req, 0, 0);
 
@@ -7048,7 +7045,7 @@ void reply_getattrE(struct smb_request *req)
 		return;
 	}
 
-	fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
+	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
 
 	if(!fsp || (fsp->conn != conn)) {
 		reply_doserror(req, ERRDOS, ERRbadfid);
-- 
cgit 


From 792324bf5a2bb29144c5ef6525d7d84f4934c93d Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Sun, 2 Nov 2008 22:20:48 +0100
Subject: Remove the inbuf reference from map_checkpath_error()

---
 source3/smbd/reply.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 2aa3c1b841..d88069c9df 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -821,10 +821,10 @@ void reply_ioctl(struct smb_request *req)
  Strange checkpath NTSTATUS mapping.
 ****************************************************************************/
 
-static NTSTATUS map_checkpath_error(const char *inbuf, NTSTATUS status)
+static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
 {
 	/* Strange DOS error code semantics only for checkpath... */
-	if (!(SVAL(inbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) {
+	if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
 		if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
 			/* We need to map to ERRbadpath */
 			return NT_STATUS_OBJECT_PATH_NOT_FOUND;
@@ -851,7 +851,7 @@ void reply_checkpath(struct smb_request *req)
 			    STR_TERMINATE, &status);
 
 	if (!NT_STATUS_IS_OK(status)) {
-		status = map_checkpath_error((char *)req->inbuf, status);
+		status = map_checkpath_error(req->flags2, status);
 		reply_nterror(req, status);
 		END_PROFILE(SMBcheckpath);
 		return;
@@ -911,7 +911,7 @@ void reply_checkpath(struct smb_request *req)
 		one at a time - if a component fails it expects
 		ERRbadpath, not ERRbadfile.
 	*/
-	status = map_checkpath_error((char *)req->inbuf, status);
+	status = map_checkpath_error(req->flags2, status);
 	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 		/*
 		 * Windows returns different error codes if
-- 
cgit 


From 7808a2594c22ff452d54d2e9e272aa60e4b7e482 Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Sun, 2 Nov 2008 22:33:20 +0100
Subject: Remove some inbuf references by adding "cmd" to smb_request

---
 source3/smbd/reply.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index d88069c9df..7b5ed8feb4 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -1227,13 +1227,13 @@ void reply_search(struct smb_request *req)
 	}
 
 	if (lp_posix_pathnames()) {
-		reply_unknown_new(req, CVAL(req->inbuf, smb_com));
+		reply_unknown_new(req, req->cmd);
 		END_PROFILE(SMBsearch);
 		return;
 	}
 
 	/* If we were called as SMBffirst then we must expect close. */
-	if(CVAL(req->inbuf,smb_com) == SMBffirst) {
+	if(req->cmd == SMBffirst) {
 		expect_close = True;
 	}
 
@@ -1443,7 +1443,7 @@ void reply_search(struct smb_request *req)
 	}
 
 	/* If we were called as SMBfunique, then we can close the dirptr now ! */
-	if(dptr_num >= 0 && CVAL(req->inbuf,smb_com) == SMBfunique) {
+	if(dptr_num >= 0 && req->cmd == SMBfunique) {
 		dptr_close(&dptr_num);
 	}
 
@@ -1476,7 +1476,7 @@ void reply_search(struct smb_request *req)
 	}
 
 	DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
-		smb_fn_name(CVAL(req->inbuf,smb_com)),
+		smb_fn_name(req->cmd),
 		mask,
 		directory ? directory : "./",
 		dirtype,
@@ -1505,7 +1505,7 @@ void reply_fclose(struct smb_request *req)
 	START_PROFILE(SMBfclose);
 
 	if (lp_posix_pathnames()) {
-		reply_unknown_new(req, CVAL(req->inbuf, smb_com));
+		reply_unknown_new(req, req->cmd);
 		END_PROFILE(SMBfclose);
 		return;
 	}
@@ -1891,7 +1891,6 @@ void reply_mknew(struct smb_request *req)
 {
 	connection_struct *conn = req->conn;
 	char *fname = NULL;
-	int com;
 	uint32 fattr = 0;
 	struct timespec ts[2];
 	files_struct *fsp;
@@ -1914,7 +1913,6 @@ void reply_mknew(struct smb_request *req)
 
 	fattr = SVAL(req->vwv+0, 0);
 	oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
-	com = SVAL(req->inbuf,smb_com);
 
 	ts[1] = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
 			/* mtime. */
@@ -1932,7 +1930,7 @@ void reply_mknew(struct smb_request *req)
 			"please report this\n", fname));
 	}
 
-	if(com == SMBmknew) {
+	if(req->cmd == SMBmknew) {
 		/* We should fail if file exists. */
 		create_disposition = FILE_CREATE;
 	} else {
-- 
cgit 


From e4897a5376309bd73727f4130bf9bc6170158a6f Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Mon, 3 Nov 2008 20:16:09 +0100
Subject: Add construct_reply_common_req wrapper

The goal is to remove the remaining direct calls to construct_reply_common.
---
 source3/smbd/reply.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 7b5ed8feb4..377ba4e530 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -3129,7 +3129,7 @@ static void send_file_readX(connection_struct *conn, struct smb_request *req,
 
 		header = data_blob_const(headerbuf, sizeof(headerbuf));
 
-		construct_reply_common((char *)req->inbuf, (char *)headerbuf);
+		construct_reply_common_req(req, (char *)headerbuf);
 		setup_readX_header((char *)headerbuf, smb_maxcnt);
 
 		if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
@@ -3181,7 +3181,7 @@ normal_read:
 	if ((smb_maxcnt & 0xFF0000) > 0x10000) {
 		uint8 headerbuf[smb_size + 2*12];
 
-		construct_reply_common((char *)req->inbuf, (char *)headerbuf);
+		construct_reply_common_req(req, (char *)headerbuf);
 		setup_readX_header((char *)headerbuf, smb_maxcnt);
 
 		/* Send out the header. */
-- 
cgit 


From 8637dd12325369e0056d77924cac577a67f2a0ab Mon Sep 17 00:00:00 2001
From: Volker Lendecke <vl@samba.org>
Date: Thu, 6 Nov 2008 20:16:04 +0100
Subject: change CHECK_READ to use smb_request instead of inbuf

---
 source3/smbd/reply.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'source3/smbd/reply.c')

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 377ba4e530..be39fd464d 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -2894,7 +2894,7 @@ void reply_lockread(struct smb_request *req)
 		return;
 	}
 
-	if (!CHECK_READ(fsp,req->inbuf)) {
+	if (!CHECK_READ(fsp,req)) {
 		reply_doserror(req, ERRDOS, ERRbadaccess);
 		END_PROFILE(SMBlockread);
 		return;
@@ -3002,7 +3002,7 @@ void reply_read(struct smb_request *req)
 		return;
 	}
 
-	if (!CHECK_READ(fsp,req->inbuf)) {
+	if (!CHECK_READ(fsp,req)) {
 		reply_doserror(req, ERRDOS, ERRbadaccess);
 		END_PROFILE(SMBread);
 		return;
@@ -3255,7 +3255,7 @@ void reply_read_and_X(struct smb_request *req)
 		return;
 	}
 
-	if (!CHECK_READ(fsp,req->inbuf)) {
+	if (!CHECK_READ(fsp,req)) {
 		reply_doserror(req, ERRDOS,ERRbadaccess);
 		END_PROFILE(SMBreadX);
 		return;
-- 
cgit