rpc_parse/parse_buffer.c

ソースコードを見る。

関数
void	rpcbuf_init (RPC_BUFFER *buffer, uint32 size, TALLOC_CTX *ctx)
BOOL	prs_rpcbuffer (const char *desc, prs_struct *ps, int depth, RPC_BUFFER *buffer)
BOOL	prs_rpcbuffer_p (const char *desc, prs_struct *ps, int depth, RPC_BUFFER **buffer)
BOOL	rpcbuf_alloc_size (RPC_BUFFER *buffer, uint32 buffer_size)
void	rpcbuf_move (RPC_BUFFER *src, RPC_BUFFER **dest)
uint32	rpcbuf_get_size (RPC_BUFFER *buffer)
BOOL	smb_io_relstr (const char *desc, RPC_BUFFER *buffer, int depth, UNISTR *string)
BOOL	smb_io_relarraystr (const char *desc, RPC_BUFFER *buffer, int depth, uint16 **string)
BOOL	smb_io_relsecdesc (const char *desc, RPC_BUFFER *buffer, int depth, SEC_DESC **secdesc)
uint32	size_of_relative_string (UNISTR *string)

---

関数

void rpcbuf_init	(	RPC_BUFFER *	buffer,
		uint32	size,
		TALLOC_CTX *	ctx
	)

parse_buffer.c の 34 行で定義されています。

参照先 RPC_BUFFER::prs・prs_init()・RPC_BUFFER::size・RPC_BUFFER::string_at_end・RPC_BUFFER::struct_start.

参照元 _spoolss_xcvdataport()・_svcctl_enum_dependent_services()・_svcctl_query_service_config2()・_svcctl_query_service_sec()・_svcctl_query_service_status_ex()・rpccli_spoolss_enum_ports()・rpccli_spoolss_enum_printers()・rpccli_spoolss_enumforms()・rpccli_spoolss_enumjobs()・rpccli_spoolss_enumprinterdrivers()・rpccli_spoolss_getform()・rpccli_spoolss_getjob()・rpccli_spoolss_getprinter()・rpccli_spoolss_getprinterdriver()・rpccli_spoolss_getprinterdriverdir()・rpccli_spoolss_getprintprocessordirectory().

{
        buffer->size = size;
        buffer->string_at_end = size;
        prs_init(&buffer->prs, size, ctx, MARSHALL);
        buffer->struct_start = prs_offset(&buffer->prs);
}

BOOL prs_rpcbuffer	(	const char *	desc,
		prs_struct *	ps,
		int	depth,
		RPC_BUFFER *	buffer
	)

parse_buffer.c の 46 行で定義されています。

参照先 RPC_BUFFER::prs・prs_debug()・prs_init()・prs_mem_free()・RPC_BUFFER::size・RPC_BUFFER::string_at_end.

参照元 prs_rpcbuffer_p()・spoolss_io_q_xcvdataport()・spoolss_io_r_xcvdataport()・svcctl_io_q_set_service_sec()・svcctl_io_r_enum_dependent_services()・svcctl_io_r_enum_services_status()・svcctl_io_r_query_service_config2()・svcctl_io_r_query_service_sec()・svcctl_io_r_query_service_status_ex().

{
        prs_debug(ps, depth, desc, "prs_rpcbuffer");
        depth++;

        /* reading */
        if (UNMARSHALLING(ps)) {
                buffer->size=0;
                buffer->string_at_end=0;
                
                if (!prs_uint32("size", ps, depth, &buffer->size))
                        return False;
                                        
                /*
                 * JRA. I'm not sure if the data in here is in big-endian format if
                 * the client is big-endian. Leave as default (little endian) for now.
                 */

                if (!prs_init(&buffer->prs, buffer->size, prs_get_mem_context(ps), UNMARSHALL))
                        return False;

                if (!prs_append_some_prs_data(&buffer->prs, ps, prs_offset(ps), buffer->size))
                        return False;

                if (!prs_set_offset(&buffer->prs, 0))
                        return False;

                if (!prs_set_offset(ps, buffer->size+prs_offset(ps)))
                        return False;

                buffer->string_at_end=buffer->size;
                
                return True;
        }
        else {
                BOOL ret = False;

                if (!prs_uint32("size", ps, depth, &buffer->size))
                        goto out;

                if (!prs_append_some_prs_data(ps, &buffer->prs, 0, buffer->size))
                        goto out;

                ret = True;
        out:

                /* We have finished with the data in buffer->prs - free it. */
                prs_mem_free(&buffer->prs);

                return ret;
        }
}

BOOL prs_rpcbuffer_p	(	const char *	desc,
		prs_struct *	ps,
		int	depth,
		RPC_BUFFER **	buffer
	)

parse_buffer.c の 103 行で定義されています。

参照先 prs_rpcbuffer().

参照元 spoolss_io_q_addjob()・spoolss_io_q_enumforms()・spoolss_io_q_enumjobs()・spoolss_io_q_enumports()・spoolss_io_q_enumprinterdrivers()・spoolss_io_q_enumprinters()・spoolss_io_q_enumprintmonitors()・spoolss_io_q_enumprintprocdatatypes()・spoolss_io_q_enumprintprocessors()・spoolss_io_q_getform()・spoolss_io_q_getjob()・spoolss_io_q_getprinter()・spoolss_io_q_getprinterdriver2()・spoolss_io_q_getprinterdriverdir()・spoolss_io_q_getprintprocessordirectory()・spoolss_io_r_addjob()・spoolss_io_r_enumforms()・spoolss_io_r_enumjobs()・spoolss_io_r_enumports()・spoolss_io_r_enumprinterdrivers()・spoolss_io_r_enumprinters()・spoolss_io_r_enumprintmonitors()・spoolss_io_r_enumprintprocdatatypes()・spoolss_io_r_enumprintprocessors()・spoolss_io_r_getform()・spoolss_io_r_getjob()・spoolss_io_r_getprinter()・spoolss_io_r_getprinterdriver2()・spoolss_io_r_getprinterdriverdir()・spoolss_io_r_getprintprocessordirectory().

{
        uint32 data_p;

        /* caputure the pointer value to stream */

        data_p = *buffer ? 0xf000baaa : 0;

        if ( !prs_uint32("ptr", ps, depth, &data_p ))
                return False;

        /* we're done if there is no data */

        if ( !data_p )
                return True;

        if ( UNMARSHALLING(ps) ) {
                if ( !(*buffer = PRS_ALLOC_MEM(ps, RPC_BUFFER, 1)) )
                        return False;
        } else {
                /* Marshalling case. - coverity paranoia - should already be ok if data_p != 0 */
                if (!*buffer) {
                        return True;
                }
        }

        return prs_rpcbuffer( desc, ps, depth, *buffer);
}

BOOL rpcbuf_alloc_size	(	RPC_BUFFER *	buffer,
		uint32	buffer_size
	)

parse_buffer.c の 136 行で定義されています。

参照先 RPC_BUFFER::prs・RPC_BUFFER::string_at_end.

参照元 _spoolss_enumforms()・_spoolss_getform()・enum_all_printers_info_1()・enum_all_printers_info_1_remote()・enum_all_printers_info_2()・enumjobs_level1()・enumjobs_level2()・enumports_level_1()・enumports_level_2()・enumprinterdrivers_level1()・enumprinterdrivers_level2()・enumprinterdrivers_level3()・enumprintmonitors_level_1()・enumprintmonitors_level_2()・enumprintprocdatatypes_level_1()・enumprintprocessors_level_1()・getjob_level_1()・getjob_level_2()・getprinter_level_0()・getprinter_level_1()・getprinter_level_2()・getprinter_level_3()・getprinter_level_4()・getprinter_level_5()・getprinter_level_7()・getprinterdriver2_level1()・getprinterdriver2_level2()・getprinterdriver2_level3()・getprinterdriver2_level6()・getprinterdriverdir_level_1()・getprintprocessordirectory_level_1().

{
        prs_struct *ps;
        uint32 extra_space;
        uint32 old_offset;
        
        /* if we don't need anything. don't do anything */
        
        if ( buffer_size == 0x0 )
                return True;

        if (!buffer) {
                return False;
        }

        ps= &buffer->prs;

        /* damn, I'm doing the reverse operation of prs_grow() :) */
        if (buffer_size < prs_data_size(ps))
                extra_space=0;
        else    
                extra_space = buffer_size - prs_data_size(ps);

        /*
         * save the offset and move to the end of the buffer
         * prs_grow() checks the extra_space against the offset
         */
        old_offset=prs_offset(ps);      
        prs_set_offset(ps, prs_data_size(ps));
        
        if (!prs_grow(ps, extra_space))
                return False;

        prs_set_offset(ps, old_offset);

        buffer->string_at_end=prs_data_size(ps);

        return True;
}

void rpcbuf_move	(	RPC_BUFFER *	src,
		RPC_BUFFER **	dest
	)

parse_buffer.c の 183 行で定義されています。

参照先 RPC_BUFFER::prs・prs_mem_clear().

参照元 _spoolss_addjob()・_spoolss_enumforms()・_spoolss_enumjobs()・_spoolss_enumports()・_spoolss_enumprinterdrivers()・_spoolss_enumprinters()・_spoolss_enumprintmonitors()・_spoolss_enumprintprocdatatypes()・_spoolss_enumprintprocessors()・_spoolss_getform()・_spoolss_getjob()・_spoolss_getprinter()・_spoolss_getprinterdriver2()・_spoolss_getprinterdriverdirectory()・_spoolss_getprintprocessordirectory().

{
        if ( !src ) {
                *dest = NULL;
                return;
        }

        prs_switch_type( &src->prs, MARSHALL );

        if ( !prs_set_offset(&src->prs, 0) )
                return;

        prs_force_dynamic( &src->prs );
        prs_mem_clear( &src->prs );

        *dest = src;
}

uint32 rpcbuf_get_size

(

RPC_BUFFER *

buffer

)

parse_buffer.c の 205 行で定義されています。

参照先 RPC_BUFFER::size.

参照元 xcvlocal_monitorui()・xcvtcp_monitorui().

{
        return (buffer->size);
}

BOOL smb_io_relstr	(	const char *	desc,
		RPC_BUFFER *	buffer,
		int	depth,
		UNISTR *	string
	)

parse_buffer.c の 231 行で定義されています。

参照先 RPC_BUFFER::prs・size_of_relative_string()・smb_io_unistr()・string・RPC_BUFFER::string_at_end・RPC_BUFFER::struct_start.

参照元 smb_io_form_1()・smb_io_job_info_1()・smb_io_job_info_2()・smb_io_port_1()・smb_io_port_2()・smb_io_port_info_1()・smb_io_port_info_2()・smb_io_printer_driver_info_1()・smb_io_printer_driver_info_2()・smb_io_printer_driver_info_3()・smb_io_printer_driver_info_6()・smb_io_printer_info_0()・smb_io_printer_info_1()・smb_io_printer_info_2()・smb_io_printer_info_4()・smb_io_printer_info_5()・smb_io_printer_info_7()・smb_io_printmonitor_info_1()・smb_io_printmonitor_info_2()・smb_io_printprocdatatype_info_1()・smb_io_printprocessor_info_1()・svcctl_io_enum_services_status().

{
        prs_struct *ps=&buffer->prs;
        
        if (MARSHALLING(ps)) {
                uint32 struct_offset = prs_offset(ps);
                uint32 relative_offset;
                
                buffer->string_at_end -= (size_of_relative_string(string) - 4);
                if(!prs_set_offset(ps, buffer->string_at_end))
                        return False;
#if 0   /* JERRY */
                /*
                 * Win2k does not align strings in a buffer
                 * Tested against WinNT 4.0 SP 6a & 2k SP2  --jerry
                 */
                if (!prs_align(ps))
                        return False;
#endif
                buffer->string_at_end = prs_offset(ps);
                
                /* write the string */
                if (!smb_io_unistr(desc, string, ps, depth))
                        return False;

                if(!prs_set_offset(ps, struct_offset))
                        return False;
                
                relative_offset=buffer->string_at_end - buffer->struct_start;
                /* write its offset */
                if (!prs_uint32("offset", ps, depth, &relative_offset))
                        return False;
        }
        else {
                uint32 old_offset;
                
                /* read the offset */
                if (!prs_uint32("offset", ps, depth, &(buffer->string_at_end)))
                        return False;

                if (buffer->string_at_end == 0)
                        return True;

                old_offset = prs_offset(ps);
                if(!prs_set_offset(ps, buffer->string_at_end+buffer->struct_start))
                        return False;

                /* read the string */
                if (!smb_io_unistr(desc, string, ps, depth))
                        return False;

                if(!prs_set_offset(ps, old_offset))
                        return False;
        }
        return True;
}

BOOL smb_io_relarraystr	(	const char *	desc,
		RPC_BUFFER *	buffer,
		int	depth,
		uint16 **	string
	)

parse_buffer.c の 293 行で定義されています。

参照先 UNISTR::buffer・RPC_BUFFER::prs・smb_io_unistr()・str_len_uni()・RPC_BUFFER::string_at_end・RPC_BUFFER::struct_start.

参照元 smb_io_printer_driver_info_3()・smb_io_printer_driver_info_6().

{
        UNISTR chaine;
        
        prs_struct *ps=&buffer->prs;
        
        if (MARSHALLING(ps)) {
                uint32 struct_offset = prs_offset(ps);
                uint32 relative_offset;
                uint16 *p;
                uint16 *q;
                uint16 zero=0;
                p=*string;
                q=*string;

                /* first write the last 0 */
                buffer->string_at_end -= 2;
                if(!prs_set_offset(ps, buffer->string_at_end))
                        return False;

                if(!prs_uint16("leading zero", ps, depth, &zero))
                        return False;

                while (p && (*p!=0)) {  
                        while (*q!=0)
                                q++;

                        /* Yes this should be malloc not talloc. Don't change. */

                        chaine.buffer = (uint16 *)
                                SMB_MALLOC((q-p+1)*sizeof(uint16));
                        if (chaine.buffer == NULL)
                                return False;

                        memcpy(chaine.buffer, p, (q-p+1)*sizeof(uint16));

                        buffer->string_at_end -= (q-p+1)*sizeof(uint16);

                        if(!prs_set_offset(ps, buffer->string_at_end)) {
                                SAFE_FREE(chaine.buffer);
                                return False;
                        }

                        /* write the string */
                        if (!smb_io_unistr(desc, &chaine, ps, depth)) {
                                SAFE_FREE(chaine.buffer);
                                return False;
                        }
                        q++;
                        p=q;

                        SAFE_FREE(chaine.buffer);
                }
                
                if(!prs_set_offset(ps, struct_offset))
                        return False;
                
                relative_offset=buffer->string_at_end - buffer->struct_start;
                /* write its offset */
                if (!prs_uint32("offset", ps, depth, &relative_offset))
                        return False;

        } else {

                /* UNMARSHALLING */

                uint32 old_offset;
                uint16 *chaine2=NULL;
                int l_chaine=0;
                int l_chaine2=0;
                size_t realloc_size = 0;

                *string=NULL;
                                
                /* read the offset */
                if (!prs_uint32("offset", ps, depth, &buffer->string_at_end))
                        return False;

                old_offset = prs_offset(ps);
                if(!prs_set_offset(ps, buffer->string_at_end + buffer->struct_start))
                        return False;
        
                do {
                        if (!smb_io_unistr(desc, &chaine, ps, depth))
                                return False;
                        
                        l_chaine=str_len_uni(&chaine);
                        
                        /* we're going to add two more bytes here in case this
                           is the last string in the array and we need to add 
                           an extra NULL for termination */
                        if (l_chaine > 0) {
                                realloc_size = (l_chaine2+l_chaine+2)*sizeof(uint16);

                                /* Yes this should be realloc - it's freed below. JRA */

                                if((chaine2=(uint16 *)SMB_REALLOC(chaine2, realloc_size)) == NULL) {
                                        return False;
                                }
                                memcpy(chaine2+l_chaine2, chaine.buffer, (l_chaine+1)*sizeof(uint16));
                                l_chaine2+=l_chaine+1;
                        }
                
                } while(l_chaine!=0);
                
                /* the end should be bould NULL terminated so add 
                   the second one here */
                if (chaine2)
                {
                        chaine2[l_chaine2] = '\0';
                        *string=(uint16 *)TALLOC_MEMDUP(prs_get_mem_context(ps),chaine2,realloc_size);
                        if (!*string) {
                                return False;
                        }
                        SAFE_FREE(chaine2);
                }

                if(!prs_set_offset(ps, old_offset))
                        return False;
        }
        return True;
}

BOOL smb_io_relsecdesc	(	const char *	desc,
		RPC_BUFFER *	buffer,
		int	depth,
		SEC_DESC **	secdesc
	)

parse_buffer.c の 420 行で定義されています。

参照先 RPC_BUFFER::prs・prs_debug()・sec_desc_size()・sec_io_desc()・RPC_BUFFER::string_at_end・RPC_BUFFER::struct_start.

参照元 smb_io_printer_info_2().

{
        prs_struct *ps= &buffer->prs;

        prs_debug(ps, depth, desc, "smb_io_relsecdesc");
        depth++;

        if (MARSHALLING(ps)) {
                uint32 struct_offset = prs_offset(ps);
                uint32 relative_offset;

                if (! *secdesc) {
                        relative_offset = 0;
                        if (!prs_uint32("offset", ps, depth, &relative_offset))
                                return False;
                        return True;
                }
                
                if (*secdesc != NULL) {
                        buffer->string_at_end -= sec_desc_size(*secdesc);

                        if(!prs_set_offset(ps, buffer->string_at_end))
                                return False;
                        /* write the secdesc */
                        if (!sec_io_desc(desc, secdesc, ps, depth))
                                return False;

                        if(!prs_set_offset(ps, struct_offset))
                                return False;
                }

                relative_offset=buffer->string_at_end - buffer->struct_start;
                /* write its offset */

                if (!prs_uint32("offset", ps, depth, &relative_offset))
                        return False;
        } else {
                uint32 old_offset;
                
                /* read the offset */
                if (!prs_uint32("offset", ps, depth, &buffer->string_at_end))
                        return False;

                old_offset = prs_offset(ps);
                if(!prs_set_offset(ps, buffer->string_at_end + buffer->struct_start))
                        return False;

                /* read the sd */
                if (!sec_io_desc(desc, secdesc, ps, depth))
                        return False;

                if(!prs_set_offset(ps, old_offset))
                        return False;
        }
        return True;
}

uint32 size_of_relative_string

(

UNISTR *

string

)

parse_buffer.c の 485 行で定義されています。

参照先 size・str_len_uni()・string.

参照元 smb_io_relstr()・spoolss_size_form_1()・spoolss_size_job_info_1()・spoolss_size_job_info_2()・spoolss_size_port_info_1()・spoolss_size_port_info_2()・spoolss_size_printer_driver_info_1()・spoolss_size_printer_driver_info_2()・spoolss_size_printer_driver_info_3()・spoolss_size_printer_driver_info_6()・spoolss_size_printer_info_0()・spoolss_size_printer_info_1()・spoolss_size_printer_info_2()・spoolss_size_printer_info_4()・spoolss_size_printer_info_5()・spoolss_size_printer_info_7()・spoolss_size_printmonitor_info_1()・spoolss_size_printmonitor_info_2()・spoolss_size_printprocdatatype_info_1()・spoolss_size_printprocessor_info_1()・svcctl_sizeof_enum_services_status().

{
        uint32 size=0;
        
        size=str_len_uni(string);       /* the string length       */
        size=size+1;                    /* add the trailing zero   */
        size=size*2;                    /* convert in char         */
        size=size+4;                    /* add the size of the ptr */   

#if 0   /* JERRY */
        /* 
         * Do not include alignment as Win2k does not align relative
         * strings within a buffer   --jerry 
         */
        /* Ensure size is 4 byte multiple (prs_align is being called...). */
        /* size += ((4 - (size & 3)) & 3); */
#endif 

        return size;
}

---