9 files changed, 421 insertions, 95 deletions

diff --git a/source4/librpc/ndr/libndr.h b/source4/librpc/ndr/libndr.h
index da262af00c8..287046ad20a 100644
--- a/source4/librpc/ndr/libndr.h
+++ b/source4/librpc/ndr/libndr.h
@@ -76,6 +76,12 @@ struct ndr_print {
 #define NDR_PRINT_UNION_DEBUG(type, level, p) ndr_print_union_debug((ndr_print_union_fn_t)ndr_print_ ##type, #p, level, p)
 
 
+enum ndr_err_code {
+	NDR_ERR_CONFORMANT_SIZE,
+	NDR_ERR_ARRAY_SIZE,
+	NDR_ERR_BAD_SWITCH
+};
+
 /*
   flags passed to control parse flow
 */
@@ -91,11 +97,14 @@ struct ndr_print {
                         } while (0)
 
 
-#define NDR_ALLOC(ndr, s) do { \
-	                       (s) = talloc(ndr->mem_ctx, sizeof(*(s))); \
+#define NDR_ALLOC_SIZE(ndr, s, size) do { \
+	                       (s) = talloc(ndr->mem_ctx, size); \
                                if (!(s)) return NT_STATUS_NO_MEMORY; \
                            } while (0)
 
+#define NDR_ALLOC(ndr, s) NDR_ALLOC_SIZE(ndr, s, sizeof(*(s)))
+
+
 #define NDR_ALLOC_N_SIZE(ndr, s, n, elsize) do { \
 				if ((n) == 0) { \
 					(s) = NULL; \
@@ -104,6 +113,7 @@ struct ndr_print {
 					if (!(s)) return NT_STATUS_NO_MEMORY; \
 				} \
                            } while (0)
+
 #define NDR_ALLOC_N(ndr, s, n) NDR_ALLOC_N_SIZE(ndr, s, n, sizeof(*(s)))
 
 /* these are used when generic fn pointers are needed for ndr push/pull fns */
diff --git a/source4/librpc/ndr/ndr.c b/source4/librpc/ndr/ndr.c
index eebc2ac681c..307f5988f84 100644
--- a/source4/librpc/ndr/ndr.c
+++ b/source4/librpc/ndr/ndr.c
@@ -192,7 +192,7 @@ NTSTATUS ndr_push_set_offset(struct ndr_push *ndr, uint32 ofs)
 /*
   push a generic array
 */
-NTSTATUS ndr_push_const_array(struct ndr_push *ndr, int ndr_flags, void *base, 
+NTSTATUS ndr_push_array(struct ndr_push *ndr, int ndr_flags, void *base, 
 			      size_t elsize, uint32 count, 
 			      NTSTATUS (*push_fn)(struct ndr_push *, int, void *))
 {
@@ -215,22 +215,11 @@ done:
 }
 
 /*
-  push a generic array
-*/
-NTSTATUS ndr_push_array(struct ndr_push *ndr, int ndr_flags, void *base, 
-			size_t elsize, uint32 count, 
-			NTSTATUS (*push_fn)(struct ndr_push *, int, void *))
-{
-	NDR_CHECK(ndr_push_uint32(ndr, count));
-	return ndr_push_const_array(ndr, ndr_flags, base, elsize, count, push_fn);
-}
-
-/*
   pull a constant sized array
 */
-NTSTATUS ndr_pull_const_array(struct ndr_pull *ndr, int ndr_flags, void *base, 
-			      size_t elsize, uint32 count, 
-			      NTSTATUS (*pull_fn)(struct ndr_pull *, int, void *))
+NTSTATUS ndr_pull_array(struct ndr_pull *ndr, int ndr_flags, void *base, 
+			size_t elsize, uint32 count, 
+			NTSTATUS (*pull_fn)(struct ndr_pull *, int, void *))
 {
 	int i;
 	char *p;
@@ -251,23 +240,6 @@ done:
 	return NT_STATUS_OK;
 }
 
-/*
-  pull a generic array
-*/
-NTSTATUS ndr_pull_array(struct ndr_pull *ndr, int ndr_flags, void *base, 
-			size_t elsize, uint32 count, 
-			NTSTATUS (*pull_fn)(struct ndr_pull *, int, void *))
-{
-	uint32 max_count;
-	NDR_CHECK(ndr_pull_uint32(ndr, &max_count));
-	if (max_count != count) {
-		/* maybe we can cope with this? */
-		return NT_STATUS_INVALID_PARAMETER;
-	}
-	return ndr_pull_const_array(ndr, ndr_flags, base, elsize, count, pull_fn);
-}
-
-
 
 /*
   print a generic array
@@ -346,3 +318,22 @@ void ndr_print_union_debug(void (*fn)(struct ndr_print *, const char *, uint16,
 	fn(&ndr, name, level, ptr);
 	talloc_destroy(ndr.mem_ctx);
 }
+
+/*
+  return and possibly log an NDR error
+*/
+NTSTATUS ndr_pull_error(struct ndr_pull *ndr, enum ndr_err_code err, const char *format, ...)
+{
+	char *s=NULL;
+	va_list ap;
+
+	va_start(ap, format);
+	vasprintf(&s, format, ap);
+	va_end(ap);
+
+	DEBUG(3,("ndr_pull_error(%u): %s\n", err, s));
+
+	free(s);
+	/* we should map to different status codes */
+	return NT_STATUS_INVALID_PARAMETER;
+}
diff --git a/source4/librpc/ndr/ndr_basic.c b/source4/librpc/ndr/ndr_basic.c
index f1996b55f78..a643f658c06 100644
--- a/source4/librpc/ndr/ndr_basic.c
+++ b/source4/librpc/ndr/ndr_basic.c
@@ -54,11 +54,7 @@ NTSTATUS ndr_pull_uint16(struct ndr_pull *ndr, uint16 *v)
 {
 	NDR_PULL_ALIGN(ndr, 2);
 	NDR_PULL_NEED_BYTES(ndr, 2);
-	if (ndr->flags & LIBNDR_FLAG_BIGENDIAN) {
-		*v = RSVAL(ndr->data, ndr->offset);
-	} else {
-		*v = SVAL(ndr->data, ndr->offset);
-	}
+	*v = SVAL(ndr->data, ndr->offset);
 	ndr->offset += 2;
 	return NT_STATUS_OK;
 }
@@ -71,11 +67,7 @@ NTSTATUS ndr_pull_uint32(struct ndr_pull *ndr, uint32 *v)
 {
 	NDR_PULL_ALIGN(ndr, 4);
 	NDR_PULL_NEED_BYTES(ndr, 4);
-	if (ndr->flags & LIBNDR_FLAG_BIGENDIAN) {
-		*v = RIVAL(ndr->data, ndr->offset);
-	} else {
-		*v = IVAL(ndr->data, ndr->offset);
-	}
+	*v = IVAL(ndr->data, ndr->offset);
 	ndr->offset += 4;
 	return NT_STATUS_OK;
 }
@@ -87,13 +79,8 @@ NTSTATUS ndr_pull_HYPER_T(struct ndr_pull *ndr, HYPER_T *v)
 {
 	NDR_PULL_ALIGN(ndr, 8);
 	NDR_PULL_NEED_BYTES(ndr, 8);
-	if (ndr->flags & LIBNDR_FLAG_BIGENDIAN) {
-		v->low = RIVAL(ndr->data, ndr->offset);
-		v->high = RIVAL(ndr->data, ndr->offset+4);
-	} else {
-		v->low = IVAL(ndr->data, ndr->offset);
-		v->high = IVAL(ndr->data, ndr->offset+4);
-	}
+	v->low = IVAL(ndr->data, ndr->offset);
+	v->high = IVAL(ndr->data, ndr->offset+4);
 	ndr->offset += 8;
 	return NT_STATUS_OK;
 }
@@ -125,12 +112,7 @@ NTSTATUS ndr_pull_bytes(struct ndr_pull *ndr, char *data, uint32 n)
 */
 NTSTATUS ndr_pull_array_uint8(struct ndr_pull *ndr, char *data, uint32 n)
 {
-	uint32 len;
-	NDR_CHECK(ndr_pull_uint32(ndr, &len));
-	if (len != n) {
-		return NT_STATUS_INVALID_PARAMETER;
-	}	
-	return ndr_pull_bytes(ndr, data, len);
+	return ndr_pull_bytes(ndr, data, n);
 }
 
 
@@ -139,11 +121,7 @@ NTSTATUS ndr_pull_array_uint8(struct ndr_pull *ndr, char *data, uint32 n)
 */
 NTSTATUS ndr_pull_array_uint16(struct ndr_pull *ndr, uint16 *data, uint32 n)
 {
-	uint32 len, i;
-	NDR_CHECK(ndr_pull_uint32(ndr, &len));
-	if (len != n) {
-		return NT_STATUS_INVALID_PARAMETER;
-	}	
+	uint32 i;
 	for (i=0;i<n;i++) {
 		NDR_CHECK(ndr_pull_uint16(ndr, &data[i]));
 	}
@@ -153,7 +131,7 @@ NTSTATUS ndr_pull_array_uint16(struct ndr_pull *ndr, uint16 *data, uint32 n)
 /*
   pull a const array of uint32
 */
-NTSTATUS ndr_pull_const_array_uint32(struct ndr_pull *ndr, uint32 *data, uint32 n)
+NTSTATUS ndr_pull_array_uint32(struct ndr_pull *ndr, uint32 *data, uint32 n)
 {
 	uint32 i;
 	for (i=0;i<n;i++) {
@@ -163,20 +141,6 @@ NTSTATUS ndr_pull_const_array_uint32(struct ndr_pull *ndr, uint32 *data, uint32
 }
 
 /*
-  pull an array of uint32
-*/
-NTSTATUS ndr_pull_array_uint32(struct ndr_pull *ndr, uint32 *data, uint32 n)
-{
-	uint32 len;
-	NDR_CHECK(ndr_pull_uint32(ndr, &len));
-	if (len != n) {
-		return NT_STATUS_INVALID_PARAMETER;
-	}	
-	return ndr_pull_const_array_uint32(ndr, data, n);
-}
-
-
-/*
   parse a GUID
 */
 NTSTATUS ndr_pull_GUID(struct ndr_pull *ndr, int ndr_flags, GUID *guid)
@@ -271,7 +235,6 @@ NTSTATUS ndr_push_bytes(struct ndr_push *ndr, const char *data, uint32 n)
 */
 NTSTATUS ndr_push_array_uint8(struct ndr_push *ndr, const char *data, uint32 n)
 {
-	NDR_CHECK(ndr_push_uint32(ndr, n));
 	return ndr_push_bytes(ndr, data, n);
 }
 
diff --git a/source4/librpc/ndr/ndr_dfs.c b/source4/librpc/ndr/ndr_dfs.c
new file mode 100644
index 00000000000..e561bdadcac
--- /dev/null
+++ b/source4/librpc/ndr/ndr_dfs.c
@@ -0,0 +1,126 @@
+/* parser auto-generated by pidl */
+
+#include "includes.h"
+
+NTSTATUS ndr_push_dfs_Exist(struct ndr_push *ndr, struct dfs_Exist *r)
+{
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_dfs_Exist(struct ndr_pull *ndr, struct dfs_Exist *r)
+{
+	NDR_CHECK(ndr_pull_uint32(ndr, r->out.exist_flag));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_push_dfs_Add(struct ndr_push *ndr, struct dfs_Add *r)
+{
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.path));
+	if (r->in.path) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.path));
+	}
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.server));
+	if (r->in.server) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.server));
+	}
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.share));
+	if (r->in.share) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.share));
+	}
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.comment));
+	if (r->in.comment) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.comment));
+	}
+	NDR_CHECK(ndr_push_uint32(ndr, r->in.flags));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_dfs_Add(struct ndr_pull *ndr, struct dfs_Add *r)
+{
+	NDR_CHECK(ndr_pull_NTSTATUS(ndr, &r->out.result));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_push_dfs_Remove(struct ndr_push *ndr, struct dfs_Remove *r)
+{
+	NDR_CHECK(ndr_push_unistr(ndr, r->in.path));
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.server));
+	if (r->in.server) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.server));
+	}
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.share));
+	if (r->in.share) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.share));
+	}
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_dfs_Remove(struct ndr_pull *ndr, struct dfs_Remove *r)
+{
+	NDR_CHECK(ndr_pull_NTSTATUS(ndr, &r->out.result));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_push_dfs_UNKNOWN3(struct ndr_push *ndr, struct dfs_UNKNOWN3 *r)
+{
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_dfs_UNKNOWN3(struct ndr_pull *ndr, struct dfs_UNKNOWN3 *r)
+{
+	NDR_CHECK(ndr_pull_NTSTATUS(ndr, &r->out.result));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_push_dfs_Info(struct ndr_push *ndr, struct dfs_Info *r)
+{
+	NDR_CHECK(ndr_push_unistr(ndr, r->in.path));
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.server));
+	if (r->in.server) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.server));
+	}
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.share));
+	if (r->in.share) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.share));
+	}
+	NDR_CHECK(ndr_push_uint16(ndr, r->in.level));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_dfs_Info(struct ndr_pull *ndr, struct dfs_Info *r)
+{
+	NDR_CHECK(ndr_pull_NTSTATUS(ndr, &r->out.result));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_push_dfs_Enum(struct ndr_push *ndr, struct dfs_Enum *r)
+{
+	NDR_CHECK(ndr_push_ptr(ndr, r->in.name));
+	if (r->in.name) {
+		NDR_CHECK(ndr_push_unistr(ndr, r->in.name));
+	}
+	NDR_CHECK(ndr_push_uint32(ndr, r->in.level));
+	NDR_CHECK(ndr_push_uint32(ndr, r->in.buffer_size));
+	NDR_CHECK(ndr_push_uint32(ndr, *r->in.resume_handle));
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_dfs_Enum(struct ndr_pull *ndr, struct dfs_Enum *r)
+{
+	NDR_CHECK(ndr_pull_uint32(ndr, r->out.resume_handle));
+	NDR_CHECK(ndr_pull_NTSTATUS(ndr, &r->out.result));
+
+	return NT_STATUS_OK;
+}
+
diff --git a/source4/librpc/ndr/ndr_dfs.h b/source4/librpc/ndr/ndr_dfs.h
new file mode 100644
index 00000000000..a1e0c2ef172
--- /dev/null
+++ b/source4/librpc/ndr/ndr_dfs.h
@@ -0,0 +1,85 @@
+/* header auto-generated by pidl */
+
+struct dfs_Exist {
+	struct {
+	} in;
+
+	struct {
+		uint32 *exist_flag;
+	} out;
+
+};
+
+struct dfs_Add {
+	struct {
+		const char *path;
+		const char *server;
+		const char *share;
+		const char *comment;
+		uint32 flags;
+	} in;
+
+	struct {
+		NTSTATUS result;
+	} out;
+
+};
+
+struct dfs_Remove {
+	struct {
+		const char *path;
+		const char *server;
+		const char *share;
+	} in;
+
+	struct {
+		NTSTATUS result;
+	} out;
+
+};
+
+struct dfs_UNKNOWN3 {
+	struct {
+	} in;
+
+	struct {
+		NTSTATUS result;
+	} out;
+
+};
+
+struct dfs_Info {
+	struct {
+		const char *path;
+		const char *server;
+		const char *share;
+		uint16 level;
+	} in;
+
+	struct {
+		NTSTATUS result;
+	} out;
+
+};
+
+struct dfs_Enum {
+	struct {
+		const char *name;
+		uint32 level;
+		uint32 buffer_size;
+		uint32 *resume_handle;
+	} in;
+
+	struct {
+		uint32 *resume_handle;
+		NTSTATUS result;
+	} out;
+
+};
+
+#define DCERPC_DFS_EXIST 0
+#define DCERPC_DFS_ADD 1
+#define DCERPC_DFS_REMOVE 2
+#define DCERPC_DFS_UNKNOWN3 3
+#define DCERPC_DFS_INFO 4
+#define DCERPC_DFS_ENUM 5
diff --git a/source4/librpc/ndr/ndr_echo.c b/source4/librpc/ndr/ndr_echo.c
index afe7f0c8736..fb186e1ce9d 100644
--- a/source4/librpc/ndr/ndr_echo.c
+++ b/source4/librpc/ndr/ndr_echo.c
@@ -19,8 +19,9 @@ NTSTATUS ndr_pull_echo_AddOne(struct ndr_pull *ndr, struct echo_AddOne *r)
 NTSTATUS ndr_push_echo_EchoData(struct ndr_push *ndr, struct echo_EchoData *r)
 {
 	NDR_CHECK(ndr_push_uint32(ndr, r->in.len));
-	if (r->in.data) {
-		NDR_CHECK(ndr_push_array_uint8(ndr, r->in.data, r->in.len));
+	if (r->in.in_data) {
+		NDR_CHECK(ndr_push_uint32(ndr, r->in.len));
+		NDR_CHECK(ndr_push_array_uint8(ndr, r->in.in_data, r->in.len));
 	}
 
 	return NT_STATUS_OK;
@@ -28,8 +29,16 @@ NTSTATUS ndr_push_echo_EchoData(struct ndr_push *ndr, struct echo_EchoData *r)
 
 NTSTATUS ndr_pull_echo_EchoData(struct ndr_pull *ndr, struct echo_EchoData *r)
 {
-	if (r->out.data) {
-		NDR_CHECK(ndr_pull_array_uint8(ndr, r->out.data, r->in.len));
+	if (r->out.out_data) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->in.len > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->in.len);
+		}
+	}
+		NDR_ALLOC_N_SIZE(ndr, r->out.out_data, r->in.len, sizeof(r->out.out_data[0]));
+		NDR_CHECK(ndr_pull_array_uint8(ndr, r->out.out_data, r->in.len));
 	}
 
 	return NT_STATUS_OK;
@@ -39,6 +48,7 @@ NTSTATUS ndr_push_echo_SinkData(struct ndr_push *ndr, struct echo_SinkData *r)
 {
 	NDR_CHECK(ndr_push_uint32(ndr, r->in.len));
 	if (r->in.data) {
+		NDR_CHECK(ndr_push_uint32(ndr, r->in.len));
 		NDR_CHECK(ndr_push_array_uint8(ndr, r->in.data, r->in.len));
 	}
 
@@ -61,9 +71,72 @@ NTSTATUS ndr_push_echo_SourceData(struct ndr_push *ndr, struct echo_SourceData *
 NTSTATUS ndr_pull_echo_SourceData(struct ndr_pull *ndr, struct echo_SourceData *r)
 {
 	if (r->out.data) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->in.len > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->in.len);
+		}
+	}
 		NDR_CHECK(ndr_pull_array_uint8(ndr, r->out.data, r->in.len));
 	}
 
 	return NT_STATUS_OK;
 }
 
+static NTSTATUS ndr_pull_Struct1(struct ndr_pull *ndr, int ndr_flags, struct Struct1 *r)
+{
+	uint32 _conformant_size;
+	NDR_CHECK(ndr_pull_uint32(ndr, &_conformant_size));
+	NDR_CHECK(ndr_pull_align(ndr, 4));
+	if (!(ndr_flags & NDR_SCALARS)) goto buffers;
+	NDR_CHECK(ndr_pull_uint32(ndr, &r->bar));
+	NDR_CHECK(ndr_pull_uint32(ndr, &r->count));
+	NDR_CHECK(ndr_pull_uint32(ndr, &r->foo));
+buffers:
+	if (!(ndr_flags & NDR_BUFFERS)) goto done;
+	if (r->count > _conformant_size) {
+		return ndr_pull_error(ndr, NDR_ERR_CONFORMANT_SIZE, "Bad conformant size %u should be %u", _conformant_size, r->count);
+	}
+		NDR_ALLOC_N_SIZE(ndr, r->s, _conformant_size, sizeof(r->s[0]));
+		NDR_CHECK(ndr_pull_array_uint32(ndr, r->s, r->count));
+done:
+	return NT_STATUS_OK;
+}
+
+void ndr_print_Struct1(struct ndr_print *ndr, const char *name, struct Struct1 *r)
+{
+	ndr_print_struct(ndr, name, "Struct1");
+	ndr->depth++;
+	ndr_print_uint32(ndr, "bar", r->bar);
+	ndr_print_uint32(ndr, "count", r->count);
+	ndr_print_uint32(ndr, "foo", r->foo);
+	ndr_print_ptr(ndr, "s", r->s);
+	ndr->depth++;
+		ndr_print_array_uint32(ndr, "s", r->s, r->count);
+	ndr->depth--;
+	ndr->depth--;
+}
+
+NTSTATUS ndr_push_TestCall(struct ndr_push *ndr, struct TestCall *r)
+{
+
+	return NT_STATUS_OK;
+}
+
+NTSTATUS ndr_pull_TestCall(struct ndr_pull *ndr, struct TestCall *r)
+{
+	uint32 _ptr_s1;
+	NDR_CHECK(ndr_pull_uint32(ndr, &_ptr_s1));
+	if (_ptr_s1) {
+		NDR_ALLOC(ndr, r->out.s1);
+	} else {
+		r->out.s1 = NULL;
+	}
+	if (r->out.s1) {
+		NDR_CHECK(ndr_pull_Struct1(ndr, NDR_SCALARS|NDR_BUFFERS, r->out.s1));
+	}
+
+	return NT_STATUS_OK;
+}
+
diff --git a/source4/librpc/ndr/ndr_echo.h b/source4/librpc/ndr/ndr_echo.h
index ed187fd4d64..b2c6774c09d 100644
--- a/source4/librpc/ndr/ndr_echo.h
+++ b/source4/librpc/ndr/ndr_echo.h
@@ -14,11 +14,11 @@ struct echo_AddOne {
 struct echo_EchoData {
 	struct {
 		uint32 len;
-		uint8 *data;
+		uint8 *in_data;
 	} in;
 
 	struct {
-		uint8 *data;
+		uint8 *out_data;
 	} out;
 
 };
@@ -45,7 +45,25 @@ struct echo_SourceData {
 
 };
 
+struct Struct1 {
+	uint32 bar;
+	uint32 count;
+	uint32 foo;
+	uint32 *s;
+};
+
+struct TestCall {
+	struct {
+	} in;
+
+	struct {
+		struct Struct1 **s1;
+	} out;
+
+};
+
 #define DCERPC_ECHO_ADDONE 0
 #define DCERPC_ECHO_ECHODATA 1
 #define DCERPC_ECHO_SINKDATA 2
 #define DCERPC_ECHO_SOURCEDATA 3
+#define DCERPC_TESTCALL 4
diff --git a/source4/librpc/ndr/ndr_lsa.c b/source4/librpc/ndr/ndr_lsa.c
index e62107a3e81..a1f01e0278d 100644
--- a/source4/librpc/ndr/ndr_lsa.c
+++ b/source4/librpc/ndr/ndr_lsa.c
@@ -123,6 +123,13 @@ static NTSTATUS ndr_pull_lsa_PrivArray(struct ndr_pull *ndr, int ndr_flags, stru
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->privs) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->count > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->count);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->privs, r->count, sizeof(r->privs[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->privs, sizeof(r->privs[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_PrivEntry));
 	}
@@ -354,12 +361,17 @@ void ndr_print_lsa_AuditLogInfo(struct ndr_print *ndr, const char *name, struct
 
 static NTSTATUS ndr_pull_lsa_AuditSettings(struct ndr_pull *ndr, int ndr_flags, struct lsa_AuditSettings *r)
 {
+	uint32 _conformant_size;
+	NDR_CHECK(ndr_pull_uint32(ndr, &_conformant_size));
 	NDR_CHECK(ndr_pull_align(ndr, 4));
 	if (!(ndr_flags & NDR_SCALARS)) goto buffers;
 	NDR_CHECK(ndr_pull_uint32(ndr, &r->count));
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
-		NDR_ALLOC_N_SIZE(ndr, r->settings, r->count, sizeof(r->settings[0]));
+	if (r->count > _conformant_size) {
+		return ndr_pull_error(ndr, NDR_ERR_CONFORMANT_SIZE, "Bad conformant size %u should be %u", _conformant_size, r->count);
+	}
+		NDR_ALLOC_N_SIZE(ndr, r->settings, _conformant_size, sizeof(r->settings[0]));
 		NDR_CHECK(ndr_pull_array_uint32(ndr, r->settings, r->count));
 done:
 	return NT_STATUS_OK;
@@ -699,7 +711,7 @@ static NTSTATUS ndr_pull_lsa_PolicyInformation(struct ndr_pull *ndr, int ndr_fla
 	break;
 
 	default:
-		return NT_STATUS_INVALID_LEVEL;
+		return ndr_pull_error(ndr, NDR_ERR_BAD_SWITCH, "Bad switch value %u in ", *level);
 	}
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
@@ -753,7 +765,7 @@ buffers:
 	break;
 
 	default:
-		return NT_STATUS_INVALID_LEVEL;
+		return ndr_pull_error(ndr, NDR_ERR_BAD_SWITCH, "Bad switch value %u in ", *level);
 	}
 done:
 	return NT_STATUS_OK;
@@ -836,7 +848,7 @@ NTSTATUS ndr_pull_lsa_QueryInfoPolicy(struct ndr_pull *ndr, struct lsa_QueryInfo
 	if (r->out.info) {
 	{ uint16 _level;
 	NDR_CHECK(ndr_pull_lsa_PolicyInformation(ndr, NDR_SCALARS|NDR_BUFFERS, &_level, r->out.info));
-	if (_level != r->in.level) return NT_STATUS_INVALID_LEVEL;
+	if (_level != r->in.level) return ndr_pull_error(ndr, NDR_ERR_BAD_SWITCH, "Bad switch value %u in info");
 	}
 	}
 	NDR_CHECK(ndr_pull_NTSTATUS(ndr, &r->out.result));
@@ -939,6 +951,7 @@ static NTSTATUS ndr_push_lsa_SidArray(struct ndr_push *ndr, int ndr_flags, struc
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->sids) {
+		NDR_CHECK(ndr_push_uint32(ndr, r->num_sids));
 		NDR_CHECK(ndr_push_array(ndr, ndr_flags, r->sids, sizeof(r->sids[0]), r->num_sids, (ndr_push_flags_fn_t)ndr_push_lsa_SidPtr));
 	}
 done:
@@ -960,6 +973,13 @@ static NTSTATUS ndr_pull_lsa_SidArray(struct ndr_pull *ndr, int ndr_flags, struc
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->sids) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->num_sids > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->num_sids);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->sids, r->num_sids, sizeof(r->sids[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->sids, sizeof(r->sids[0]), r->num_sids, (ndr_pull_flags_fn_t)ndr_pull_lsa_SidPtr));
 	}
@@ -1063,6 +1083,13 @@ static NTSTATUS ndr_pull_lsa_DomainList(struct ndr_pull *ndr, int ndr_flags, str
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->domains) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->count > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->count);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->domains, r->count, sizeof(r->domains[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->domains, sizeof(r->domains[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_DomainInformation));
 	}
@@ -1147,6 +1174,7 @@ static NTSTATUS ndr_push_lsa_TransSidArray(struct ndr_push *ndr, int ndr_flags,
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->sids) {
+		NDR_CHECK(ndr_push_uint32(ndr, r->count));
 		NDR_CHECK(ndr_push_array(ndr, ndr_flags, r->sids, sizeof(r->sids[0]), r->count, (ndr_push_flags_fn_t)ndr_push_lsa_TranslatedSid));
 	}
 done:
@@ -1168,6 +1196,13 @@ static NTSTATUS ndr_pull_lsa_TransSidArray(struct ndr_pull *ndr, int ndr_flags,
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->sids) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->count > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->count);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->sids, r->count, sizeof(r->sids[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->sids, sizeof(r->sids[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_TranslatedSid));
 	}
@@ -1241,6 +1276,13 @@ static NTSTATUS ndr_pull_lsa_RefDomainList(struct ndr_pull *ndr, int ndr_flags,
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->domains) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->count > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->count);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->domains, r->count, sizeof(r->domains[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->domains, sizeof(r->domains[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_TrustInformation));
 	}
@@ -1269,6 +1311,7 @@ NTSTATUS ndr_push_lsa_LookupNames(struct ndr_push *ndr, struct lsa_LookupNames *
 	NDR_CHECK(ndr_push_uint32(ndr, r->in.num_names));
 	if (r->in.names) {
 		int ndr_flags = NDR_SCALARS|NDR_BUFFERS;
+		NDR_CHECK(ndr_push_uint32(ndr, r->in.num_names));
 		NDR_CHECK(ndr_push_array(ndr, ndr_flags, r->in.names, sizeof(r->in.names[0]), r->in.num_names, (ndr_push_flags_fn_t)ndr_push_lsa_Name));
 	}
 	NDR_CHECK(ndr_push_lsa_TransSidArray(ndr, NDR_SCALARS|NDR_BUFFERS, r->in.sids));
@@ -1344,6 +1387,7 @@ static NTSTATUS ndr_push_lsa_TransNameArray(struct ndr_push *ndr, int ndr_flags,
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->names) {
+		NDR_CHECK(ndr_push_uint32(ndr, r->count));
 		NDR_CHECK(ndr_push_array(ndr, ndr_flags, r->names, sizeof(r->names[0]), r->count, (ndr_push_flags_fn_t)ndr_push_lsa_TranslatedName));
 	}
 done:
@@ -1365,6 +1409,13 @@ static NTSTATUS ndr_pull_lsa_TransNameArray(struct ndr_pull *ndr, int ndr_flags,
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->names) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->count > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->count);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->names, r->count, sizeof(r->names[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->names, sizeof(r->names[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_TranslatedName));
 	}
@@ -1491,14 +1542,19 @@ void ndr_print_lsa_LUIDAttribute(struct ndr_print *ndr, const char *name, struct
 
 static NTSTATUS ndr_pull_lsa_PrivilegeSet(struct ndr_pull *ndr, int ndr_flags, struct lsa_PrivilegeSet *r)
 {
+	uint32 _conformant_size;
+	NDR_CHECK(ndr_pull_uint32(ndr, &_conformant_size));
 	NDR_CHECK(ndr_pull_align(ndr, 4));
 	if (!(ndr_flags & NDR_SCALARS)) goto buffers;
 	NDR_CHECK(ndr_pull_uint32(ndr, &r->count));
+	NDR_CHECK(ndr_pull_uint32(ndr, &r->unknown));
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
-		NDR_ALLOC_N_SIZE(ndr, r->set, r->count, sizeof(r->set[0]));
+	if (r->count > _conformant_size) {
+		return ndr_pull_error(ndr, NDR_ERR_CONFORMANT_SIZE, "Bad conformant size %u should be %u", _conformant_size, r->count);
+	}
+		NDR_ALLOC_N_SIZE(ndr, r->set, _conformant_size, sizeof(r->set[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->set, sizeof(r->set[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_LUIDAttribute));
-		NDR_CHECK(ndr_pull_const_array_uint32(ndr, r->unknown, 1));
 done:
 	return NT_STATUS_OK;
 }
@@ -1508,14 +1564,11 @@ void ndr_print_lsa_PrivilegeSet(struct ndr_print *ndr, const char *name, struct
 	ndr_print_struct(ndr, name, "lsa_PrivilegeSet");
 	ndr->depth++;
 	ndr_print_uint32(ndr, "count", r->count);
+	ndr_print_uint32(ndr, "unknown", r->unknown);
 	ndr_print_ptr(ndr, "set", r->set);
 	ndr->depth++;
 		ndr_print_array(ndr, "set", r->set, sizeof(r->set[0]), r->count, (ndr_print_fn_t)ndr_print_lsa_LUIDAttribute);
 	ndr->depth--;
-	ndr_print_ptr(ndr, "unknown", r->unknown);
-	ndr->depth++;
-		ndr_print_array_uint32(ndr, "unknown", r->unknown, 1);
-	ndr->depth--;
 	ndr->depth--;
 }
 
@@ -1805,6 +1858,13 @@ static NTSTATUS ndr_pull_lsa_RightSet(struct ndr_pull *ndr, int ndr_flags, struc
 buffers:
 	if (!(ndr_flags & NDR_BUFFERS)) goto done;
 	if (r->names) {
+	{
+		uint32 _array_size;
+		NDR_CHECK(ndr_pull_uint32(ndr, &_array_size));
+		if (r->count > _array_size) {
+			return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE, "Bad array size %u should be %u", _array_size, r->count);
+		}
+	}
 		NDR_ALLOC_N_SIZE(ndr, r->names, r->count, sizeof(r->names[0]));
 		NDR_CHECK(ndr_pull_array(ndr, ndr_flags, (void **)r->names, sizeof(r->names[0]), r->count, (ndr_pull_flags_fn_t)ndr_pull_lsa_Name));
 	}
diff --git a/source4/librpc/ndr/ndr_lsa.h b/source4/librpc/ndr/ndr_lsa.h
index b502064bbfe..7cc0d0f3da8 100644
--- a/source4/librpc/ndr/ndr_lsa.h
+++ b/source4/librpc/ndr/ndr_lsa.h
@@ -405,8 +405,8 @@ struct lsa_LUIDAttribute {
 
 struct lsa_PrivilegeSet {
 	uint32 count;
+	uint32 unknown;
 	struct lsa_LUIDAttribute *set;
-	uint32 unknown[1];
 };
 
 struct lsa_EnumPrivsAccount {