Hi Jeremy,
> Bug is in fsctl_qar():
>
> ndr_ret = ndr_push_struct_blob(out_output, mem_ctx, &qar_rsp,
> (ndr_push_flags_fn_t)ndr_push_fsctl_query_alloced_ranges_rsp);
> if (ndr_ret != NDR_ERR_SUCCESS) {
> DEBUG(0, ("failed to marshall QAR rsp\n"));
> return NT_STATUS_INVALID_PARAMETER;
> }
>
> if (out_output->length > in_max_output) {
> DEBUG(2, ("QAR output len %lu exceeds max %lu\n",
> (unsigned long)out_output->length,
> (unsigned long)in_max_output));
> data_blob_free(out_output);
> return NT_STATUS_BUFFER_TOO_SMALL;
> }
>
> I'm guessing in this case we need to just truncate out_output->length
> to in_max_output and return STATUS_BUFFER_OVERFLOW.
Do you perchance have a fix for this? I'm seeing it cause failures in
xfstests when running against cifs connected to samba.
Thanks,
David
