1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 * Copyright 2012 Milan Jurik. All rights reserved.
25 */
26
27 /*
28 * Network Data Representation (NDR) is a compatible subset of the DCE RPC
29 * and MSRPC NDR. NDR is used to move parameters consisting of
30 * complicated trees of data constructs between an RPC client and server.
31 */
32
33 #include <sys/byteorder.h>
34 #include <strings.h>
35 #include <assert.h>
36 #include <string.h>
37 #include <stdlib.h>
38
39 #include <smbsrv/libsmb.h>
40 #include <smbsrv/string.h>
41 #include <smbsrv/libmlrpc.h>
42
43 #define NDR_STRING_MAX 4096
44
45 #define NDR_IS_UNION(T) \
46 (((T)->type_flags & NDR_F_TYPEOP_MASK) == NDR_F_UNION)
47 #define NDR_IS_STRING(T) \
48 (((T)->type_flags & NDR_F_TYPEOP_MASK) == NDR_F_STRING)
49
50 extern ndr_typeinfo_t ndt_s_wchar;
51
52 /*
53 * The following synopsis describes the terms TOP-MOST, OUTER and INNER.
54 *
55 * Each parameter (call arguments and return values) is a TOP-MOST item.
56 * A TOP-MOST item consists of one or more OUTER items. An OUTER item
57 * consists of one or more INNER items. There are important differences
58 * between each kind, which, primarily, have to do with the allocation
59 * of memory to contain data structures and the order of processing.
60 *
61 * This is most easily demonstrated with a short example.
62 * Consider these structures:
63 *
64 * struct top_param {
65 * long level;
66 * struct list * head;
67 * long count;
68 * };
69 *
70 * struct list {
71 * struct list * next;
72 * char * str; // a string
73 * };
74 *
75 * Now, consider an instance tree like this:
76 *
77 * +---------+ +-------+ +-------+
78 * |top_param| +--->|list #1| +--->|list #2|
79 * +---------+ | +-------+ | +-------+
80 * | level | | | next ----+ | next --->(NULL)
81 * | head ----+ | str -->"foo" | str -->"bar"
82 * | count | | flag | | flag |
83 * +---------+ +-------+ +-------+
84 *
85 * The DCE(MS)/RPC Stub Data encoding for the tree is the following.
86 * The vertical bars (|) indicate OUTER construct boundaries.
87 *
88 * +-----+----------------------+----------------------+-----+-----+-----+
89 * |level|#1.next #1.str #1.flag|#2.next #2.str #2.flag|"bar"|"foo"|count|
90 * +-----+----------------------+----------------------+-----+-----+-----+
91 * level |<----------------------- head -------------------------->|count
92 * TOP TOP TOP
93 *
94 * Here's what to notice:
95 *
96 * - The members of the TOP-MOST construct are scattered through the Stub
97 * Data in the order they occur. This example shows a TOP-MOST construct
98 * consisting of atomic types (pointers and integers). A construct
99 * (struct) within the TOP-MOST construct would be contiguous and not
100 * scattered.
101 *
102 * - The members of OUTER constructs are contiguous, which allows for
103 * non-copied relocated (fixed-up) data structures at the packet's
104 * destination. We don't do fix-ups here. The pointers within the
105 * OUTER constructs are processed depth-first in the order that they
106 * occur. If they were processed breadth first, the sequence would
107 * be #1,"foo",#2,"bar". This is tricky because OUTER constructs may
108 * be variable length, and pointers are often encountered before the
109 * size(s) is known.
110 *
111 * - The INNER constructs are simply the members of an OUTER construct.
112 *
113 * For comparison, consider how ONC RPC would handle the same tree of
114 * data. ONC requires very little buffering, while DCE requires enough
115 * buffer space for the entire message. ONC does atom-by-atom depth-first
116 * (de)serialization and copy, while DCE allows for constructs to be
117 * "fixed-up" (relocated) in place at the destination. The packet data
118 * for the same tree processed by ONC RPC would look like this:
119 *
120 * +---------------------------------------------------------------------+
121 * |level #1.next #2.next #2.str "bar" #2.flag #1.str "foo" #1.flag count|
122 * +---------------------------------------------------------------------+
123 * TOP #1 #2 #2 bar #2 #1 foo #1 TOP
124 *
125 * More details about each TOP-MOST, OUTER, and INNER constructs appear
126 * throughout this source file near where such constructs are processed.
127 *
128 * NDR_REFERENCE
129 *
130 * The primary object for NDR is the ndr_ref_t.
131 *
132 * An ndr reference indicates the local datum (i.e. native "C" data
133 * format), and the element within the Stub Data (contained within the
134 * RPC PDU (protocol data unit). An ndr reference also indicates,
135 * largely as a debugging aid, something about the type of the
136 * element/datum, and the enclosing construct for the element. The
137 * ndr reference's are typically allocated on the stack as locals,
138 * and the chain of ndr-reference.enclosing references is in reverse
139 * order of the call graph.
140 *
141 * The ndr-reference.datum is a pointer to the local memory that
142 * contains/receives the value. The ndr-reference.pdu_offset indicates
143 * where in the Stub Data the value is to be stored/retrieved.
144 *
145 * The ndr-reference also contains various parameters to the NDR
146 * process, such as ndr-reference.size_is, which indicates the size
147 * of variable length data, or ndr-reference.switch_is, which
148 * indicates the arm of a union to use.
149 *
150 * QUEUE OF OUTER REFERENCES
151 *
152 * Some OUTER constructs are variable size. Sometimes (often) we don't
153 * know the size of the OUTER construct until after pointers have been
154 * encountered. Hence, we can not begin processing the referent of the
155 * pointer until after the referring OUTER construct is completely
156 * processed, i.e. we don't know where to find/put the referent in the
157 * Stub Data until we know the size of all its predecessors.
158 *
159 * This is managed using the queue of OUTER references. The queue is
160 * anchored in ndr_stream.outer_queue_head. At any time,
161 * ndr_stream.outer_queue_tailp indicates where to put the
162 * ndr-reference for the next encountered pointer.
163 *
164 * Refer to the example above as we illustrate the queue here. In these
165 * illustrations, the queue entries are not the data structures themselves.
166 * Rather, they are ndr-reference entries which **refer** to the data
167 * structures in both the PDU and local memory.
168 *
169 * During some point in the processing, the queue looks like this:
170 *
171 * outer_current -------v
172 * outer_queue_head --> list#1 --0
173 * outer_queue_tailp ---------&
174 *
175 * When the pointer #1.next is encountered, and entry is added to the
176 * queue,
177 *
178 * outer_current -------v
179 * outer_queue_head --> list#1 --> list#2 --0
180 * outer_queue_tailp --------------------&
181 *
182 * and the members of #1 continue to be processed, which encounters
183 * #1.str:
184 *
185 * outer_current -------v
186 * outer_queue_head --> list#1 --> list#2 --> "foo" --0
187 * outer_queue_tailp ------------------------------&
188 *
189 * Upon the completion of list#1, the processing continues by moving to
190 * ndr_stream.outer_current->next, and the tail is set to this outer member:
191 *
192 * outer_current ------------------v
193 * outer_queue_head --> list#1 --> list#2 --> "foo" --0
194 * outer_queue_tailp --------------------&
195 *
196 * Space for list#2 is allocated, either in the Stub Data or of local
197 * memory. When #2.next is encountered, it is found to be the null
198 * pointer and no reference is added to the queue. When #2.str is
199 * encountered, it is found to be valid, and a reference is added:
200 *
201 * outer_current ------------------v
202 * outer_queue_head --> list#1 --> list#2 --> "bar" --> "foo" --0
203 * outer_queue_tailp ------------------------------&
204 *
205 * Processing continues in a similar fashion with the string "bar",
206 * which is variable-length. At this point, memory for "bar" may be
207 * malloc()ed during NDR_M_OP_UNMARSHALL:
208 *
209 * outer_current -----------------------------v
210 * outer_queue_head --> list#1 --> list#2 --> "bar" --> "foo" --0
211 * outer_queue_tailp ------------------------------&
212 *
213 * And finishes on string "foo". Notice that because "bar" is a
214 * variable length string, and we don't know the PDU offset for "foo"
215 * until we reach this point.
216 *
217 * When the queue is drained (current->next==0), processing continues
218 * with the next TOP-MOST member.
219 *
220 * The queue of OUTER constructs manages the variable-length semantics
221 * of OUTER constructs and satisfies the depth-first requirement.
222 * We allow the queue to linger until the entire TOP-MOST structure is
223 * processed as an aid to debugging.
224 */
225
226 static ndr_ref_t *ndr_enter_outer_queue(ndr_ref_t *);
227 extern int ndr__ulong(ndr_ref_t *);
228
229 /*
230 * TOP-MOST ELEMENTS
231 *
232 * This is fundamentally the first OUTER construct of the parameter,
233 * possibly followed by more OUTER constructs due to pointers. The
234 * datum (local memory) for TOP-MOST constructs (structs) is allocated
235 * by the caller of NDR.
236 *
237 * After the element is transferred, the outer_queue is drained.
238 *
239 * All we have to do is add an entry to the outer_queue for this
240 * top-most member, and commence the outer_queue processing.
241 */
242 int
243 ndo_process(ndr_stream_t *nds, ndr_typeinfo_t *ti, char *datum)
244 {
245 ndr_ref_t myref;
246
247 bzero(&myref, sizeof (myref));
248 myref.stream = nds;
249 myref.datum = datum;
250 myref.name = "PROCESS";
251 myref.ti = ti;
252
253 return (ndr_topmost(&myref));
254 }
255
256 int
257 ndo_operation(ndr_stream_t *nds, ndr_typeinfo_t *ti, int opnum, char *datum)
258 {
259 ndr_ref_t myref;
260
261 bzero(&myref, sizeof (myref));
262 myref.stream = nds;
263 myref.datum = datum;
264 myref.name = "OPERATION";
265 myref.ti = ti;
266 myref.inner_flags = NDR_F_SWITCH_IS;
267 myref.switch_is = opnum;
268
269 if (ti->type_flags != NDR_F_INTERFACE) {
270 NDR_SET_ERROR(&myref, NDR_ERR_NOT_AN_INTERFACE);
271 return (0);
272 }
273
274 return ((*ti->ndr_func)(&myref));
275 }
276
277 int
278 ndr_params(ndr_ref_t *params_ref)
279 {
280 ndr_typeinfo_t *ti = params_ref->ti;
281
282 if (ti->type_flags == NDR_F_OPERATION)
283 return (*ti->ndr_func) (params_ref);
284 else
285 return (ndr_topmost(params_ref));
286 }
287
288 int
289 ndr_topmost(ndr_ref_t *top_ref)
290 {
291 ndr_stream_t *nds;
292 ndr_typeinfo_t *ti;
293 ndr_ref_t *outer_ref = 0;
294 int is_varlen;
295 int is_string;
296 int error;
297 int rc;
298 unsigned n_fixed;
299 int params;
300
301 assert(top_ref);
302 assert(top_ref->stream);
303 assert(top_ref->ti);
304
305 nds = top_ref->stream;
306 ti = top_ref->ti;
307
308 is_varlen = ti->pdu_size_variable_part;
309 is_string = NDR_IS_STRING(ti);
310
311 assert(nds->outer_queue_tailp && !*nds->outer_queue_tailp);
312 assert(!nds->outer_current);
313
314 params = top_ref->inner_flags & NDR_F_PARAMS_MASK;
315
316 switch (params) {
317 case NDR_F_NONE:
318 case NDR_F_SWITCH_IS:
319 if (is_string || is_varlen) {
320 error = NDR_ERR_TOPMOST_VARLEN_ILLEGAL;
321 NDR_SET_ERROR(outer_ref, error);
322 return (0);
323 }
324 n_fixed = ti->pdu_size_fixed_part;
325 break;
326
327 case NDR_F_SIZE_IS:
328 error = NDR_ERR_TOPMOST_VARLEN_ILLEGAL;
329 NDR_SET_ERROR(outer_ref, error);
330 return (0);
331
332 case NDR_F_DIMENSION_IS:
333 if (is_varlen) {
334 error = NDR_ERR_ARRAY_VARLEN_ILLEGAL;
335 NDR_SET_ERROR(outer_ref, error);
336 return (0);
337 }
338 n_fixed = ti->pdu_size_fixed_part * top_ref->dimension_is;
339 break;
340
341 case NDR_F_IS_POINTER:
342 case NDR_F_IS_POINTER+NDR_F_SIZE_IS:
343 n_fixed = 4;
344 break;
345
346 case NDR_F_IS_REFERENCE:
347 case NDR_F_IS_REFERENCE+NDR_F_SIZE_IS:
348 n_fixed = 0;
349 break;
350
351 default:
352 error = NDR_ERR_OUTER_PARAMS_BAD;
353 NDR_SET_ERROR(outer_ref, error);
354 return (0);
355 }
356
357 outer_ref = ndr_enter_outer_queue(top_ref);
358 if (!outer_ref)
359 return (0); /* error already set */
360
361 /*
362 * Hand-craft the first OUTER construct and directly call
363 * ndr_inner(). Then, run the outer_queue. We do this
364 * because ndr_outer() wants to malloc() memory for
365 * the construct, and we already have the memory.
366 */
367
368 /* move the flags, etc, around again, undoes enter_outer_queue() */
369 outer_ref->inner_flags = top_ref->inner_flags;
370 outer_ref->outer_flags = 0;
371 outer_ref->datum = top_ref->datum;
372
373 /* All outer constructs start on a mod4 (longword) boundary */
374 if (!ndr_outer_align(outer_ref))
375 return (0); /* error already set */
376
377 /* Regardless of what it is, this is where it starts */
378 outer_ref->pdu_offset = nds->pdu_scan_offset;
379
380 rc = ndr_outer_grow(outer_ref, n_fixed);
381 if (!rc)
382 return (0); /* error already set */
383
384 outer_ref->pdu_end_offset = outer_ref->pdu_offset + n_fixed;
385
386 /* set-up outer_current, as though run_outer_queue() was doing it */
387 nds->outer_current = outer_ref;
388 nds->outer_queue_tailp = &nds->outer_current->next;
389 nds->pdu_scan_offset = outer_ref->pdu_end_offset;
390
391 /* do the topmost member */
392 rc = ndr_inner(outer_ref);
393 if (!rc)
394 return (0); /* error already set */
395
396 nds->pdu_scan_offset = outer_ref->pdu_end_offset;
397
398 /* advance, as though run_outer_queue() was doing it */
399 nds->outer_current = nds->outer_current->next;
400 return (ndr_run_outer_queue(nds));
401 }
402
403 static ndr_ref_t *
404 ndr_enter_outer_queue(ndr_ref_t *arg_ref)
405 {
406 ndr_stream_t *nds = arg_ref->stream;
407 ndr_ref_t *outer_ref;
408
409 /*LINTED E_BAD_PTR_CAST_ALIGN*/
410 outer_ref = (ndr_ref_t *)NDS_MALLOC(nds, sizeof (*outer_ref), arg_ref);
411 if (!outer_ref) {
412 NDR_SET_ERROR(arg_ref, NDR_ERR_MALLOC_FAILED);
413 return (0);
414 }
415
416 *outer_ref = *arg_ref;
417
418 /* move advice in inner_flags to outer_flags */
419 outer_ref->outer_flags = arg_ref->inner_flags & NDR_F_PARAMS_MASK;
420 outer_ref->inner_flags = 0;
421 outer_ref->enclosing = nds->outer_current;
422 outer_ref->backptr = 0;
423 outer_ref->datum = 0;
424
425 assert(nds->outer_queue_tailp);
426
427 outer_ref->next = *nds->outer_queue_tailp;
428 *nds->outer_queue_tailp = outer_ref;
429 nds->outer_queue_tailp = &outer_ref->next;
430 return (outer_ref);
431 }
432
433 int
434 ndr_run_outer_queue(ndr_stream_t *nds)
435 {
436 while (nds->outer_current) {
437 nds->outer_queue_tailp = &nds->outer_current->next;
438
439 if (!ndr_outer(nds->outer_current))
440 return (0);
441
442 nds->outer_current = nds->outer_current->next;
443 }
444
445 return (1);
446 }
447
448 /*
449 * OUTER CONSTRUCTS
450 *
451 * OUTER constructs are where the real work is, which stems from the
452 * variable-length potential.
453 *
454 * DCE(MS)/RPC VARIABLE LENGTH -- CONFORMANT, VARYING, VARYING/CONFORMANT
455 *
456 * DCE(MS)/RPC provides for three forms of variable length: CONFORMANT,
457 * VARYING, and VARYING/CONFORMANT.
458 *
459 * What makes this so tough is that the variable-length array may be well
460 * encapsulated within the outer construct. Further, because DCE(MS)/RPC
461 * tries to keep the constructs contiguous in the data stream, the sizing
462 * information precedes the entire OUTER construct. The sizing information
463 * must be used at the appropriate time, which can be after many, many,
464 * many fixed-length elements. During IDL type analysis, we know in
465 * advance constructs that encapsulate variable-length constructs. So,
466 * we know when we have a sizing header and when we don't. The actual
467 * semantics of the header are largely deferred.
468 *
469 * Currently, VARYING constructs are not implemented but they are described
470 * here in case they have to be implemented in the future. Similarly,
471 * DCE(MS)/RPC provides for multi-dimensional arrays, which are currently
472 * not implemented. Only one-dimensional, variable-length arrays are
473 * supported.
474 *
475 * CONFORMANT CONSTRUCTS -- VARIABLE LENGTH ARRAYS START THE SHOW
476 *
477 * All variable-length values are arrays. These arrays may be embedded
478 * well within another construct. However, a variable-length construct
479 * may ONLY appear as the last member of an enclosing construct. Example:
480 *
481 * struct credentials {
482 * ulong uid, gid;
483 * ulong n_gids;
484 * [size_is(n_gids)]
485 * ulong gids[*]; // variable-length.
486 * };
487 *
488 * CONFORMANT constructs have a dynamic size in local memory and in the
489 * PDU. The CONFORMANT quality is indicated by the [size_is()] advice.
490 * CONFORMANT constructs have the following header:
491 *
492 * struct conformant_header {
493 * ulong size_is;
494 * };
495 *
496 * (Multi-dimensional CONFORMANT arrays have a similar header for each
497 * dimension - not implemented).
498 *
499 * Example CONFORMANT construct:
500 *
501 * struct user {
502 * char * name;
503 * struct credentials cred; // see above
504 * };
505 *
506 * Consider the data tree:
507 *
508 * +--------+
509 * | user |
510 * +--------+
511 * | name ----> "fred" (the string is a different OUTER)
512 * | uid |
513 * | gid |
514 * | n_gids | for example, 3
515 * | gids[0]|
516 * | gids[1]|
517 * | gids[2]|
518 * +--------+
519 *
520 * The OUTER construct in the Stub Data would be:
521 *
522 * +---+---------+---------------------------------------------+
523 * |pad|size_is=3 name uid gid n_gids=3 gids[0] gids[1] gids[2]|
524 * +---+---------+---------------------------------------------+
525 * szing hdr|user |<-------------- user.cred ------------>|
526 * |<--- fixed-size ---->|<----- conformant ---->|
527 *
528 * The ndr_typeinfo for struct user will have:
529 * pdu_fixed_size_part = 16 four long words (name uid gid n_gids)
530 * pdu_variable_size_part = 4 per element, sizeof gids[0]
531 *
532 * VARYING CONSTRUCTS -- NOT IMPLEMENTED
533 *
534 * VARYING constructs have the following header:
535 *
536 * struct varying_header {
537 * ulong first_is;
538 * ulong length_is;
539 * };
540 *
541 * This indicates which interval of an array is significant.
542 * Non-intersecting elements of the array are undefined and usually
543 * zero-filled. The first_is parameter for C arrays is always 0 for
544 * the first element.
545 *
546 * N.B. Constructs may contain one CONFORMANT element, which is always
547 * last, but may contain many VARYING elements, which can be anywhere.
548 *
549 * VARYING CONFORMANT constructs have the sizing headers arranged like
550 * this:
551 *
552 * struct conformant_header all_conformant[N_CONFORMANT_DIM];
553 * struct varying_header all_varying[N_VARYING_ELEMS_AND_DIMS];
554 *
555 * The sizing header is immediately followed by the values for the
556 * construct. Again, we don't support more than one dimension and
557 * we don't support VARYING constructs at this time.
558 *
559 * A good example of a VARYING/CONFORMANT data structure is the UNIX
560 * directory entry:
561 *
562 * struct dirent {
563 * ushort reclen;
564 * ushort namlen;
565 * ulong inum;
566 * [size_is(reclen-8) length_is(namlen+1)] // -(2+2+4), +1 for NUL
567 * uchar name[*];
568 * };
569 *
570 *
571 * STRINGS ARE A SPECIAL CASE
572 *
573 * Strings are handled specially. MS/RPC uses VARYING/CONFORMANT structures
574 * for strings. This is a simple one-dimensional variable-length array,
575 * typically with its last element all zeroes. We handle strings with the
576 * header:
577 *
578 * struct string_header {
579 * ulong size_is;
580 * ulong first_is; // always 0
581 * ulong length_is; // always same as size_is
582 * };
583 *
584 * If general support for VARYING and VARYING/CONFORMANT mechanisms is
585 * implemented, we probably won't need the strings special case.
586 */
587 int
588 ndr_outer(ndr_ref_t *outer_ref)
589 {
590 ndr_stream_t *nds = outer_ref->stream;
591 ndr_typeinfo_t *ti = outer_ref->ti;
592 int is_varlen = ti->pdu_size_variable_part;
593 int is_union = NDR_IS_UNION(ti);
594 int is_string = NDR_IS_STRING(ti);
595 int error = NDR_ERR_OUTER_PARAMS_BAD;
596 int params;
597
598 params = outer_ref->outer_flags & NDR_F_PARAMS_MASK;
599
600 NDR_TATTLE(outer_ref, "--OUTER--");
601
602 /* All outer constructs start on a mod4 (longword) boundary */
603 if (!ndr_outer_align(outer_ref))
604 return (0); /* error already set */
605
606 /* Regardless of what it is, this is where it starts */
607 outer_ref->pdu_offset = nds->pdu_scan_offset;
608
609 if (is_union) {
610 error = NDR_ERR_OUTER_UNION_ILLEGAL;
611 NDR_SET_ERROR(outer_ref, error);
612 return (0);
613 }
614
615 switch (params) {
616 case NDR_F_NONE:
617 if (is_string)
618 return (ndr_outer_string(outer_ref));
619 if (is_varlen)
620 return (ndr_outer_conformant_construct(outer_ref));
621
622 return (ndr_outer_fixed(outer_ref));
623
624 case NDR_F_SIZE_IS:
625 case NDR_F_DIMENSION_IS:
626 case NDR_F_IS_POINTER+NDR_F_SIZE_IS:
627 case NDR_F_IS_REFERENCE+NDR_F_SIZE_IS:
628 if (is_varlen) {
629 error = NDR_ERR_ARRAY_VARLEN_ILLEGAL;
630 break;
631 }
632
633 if (params & NDR_F_SIZE_IS)
634 return (ndr_outer_conformant_array(outer_ref));
635 else
636 return (ndr_outer_fixed_array(outer_ref));
637
638 default:
639 error = NDR_ERR_OUTER_PARAMS_BAD;
640 break;
641 }
642
643 /*
644 * If we get here, something is wrong. Most likely,
645 * the params flags do not match.
646 */
647 NDR_SET_ERROR(outer_ref, error);
648 return (0);
649 }
650
651 int
652 ndr_outer_fixed(ndr_ref_t *outer_ref)
653 {
654 ndr_stream_t *nds = outer_ref->stream;
655 ndr_typeinfo_t *ti = outer_ref->ti;
656 ndr_ref_t myref;
657 char *valp = NULL;
658 int is_varlen = ti->pdu_size_variable_part;
659 int is_union = NDR_IS_UNION(ti);
660 int is_string = NDR_IS_STRING(ti);
661 int rc;
662 unsigned n_hdr;
663 unsigned n_fixed;
664 unsigned n_variable;
665 unsigned n_alloc;
666 unsigned n_pdu_total;
667 int params;
668
669 params = outer_ref->outer_flags & NDR_F_PARAMS_MASK;
670
671 assert(!is_varlen && !is_string && !is_union);
672 assert(params == NDR_F_NONE);
673
674 /* no header for this */
675 n_hdr = 0;
676
677 /* fixed part -- exactly one of these */
678 n_fixed = ti->pdu_size_fixed_part;
679 assert(n_fixed > 0);
680
681 /* variable part -- exactly none of these */
682 n_variable = 0;
683
684 /* sum them up to determine the PDU space required */
685 n_pdu_total = n_hdr + n_fixed + n_variable;
686
687 /* similar sum to determine how much local memory is required */
688 n_alloc = n_fixed + n_variable;
689
690 rc = ndr_outer_grow(outer_ref, n_pdu_total);
691 if (!rc)
692 return (rc); /* error already set */
693
694 switch (nds->m_op) {
695 case NDR_M_OP_MARSHALL:
696 valp = outer_ref->datum;
697 if (!valp) {
698 NDR_SET_ERROR(outer_ref, NDR_ERR_OUTER_PARAMS_BAD);
699 return (0);
700 }
701 if (outer_ref->backptr)
702 assert(valp == *outer_ref->backptr);
703 break;
704
705 case NDR_M_OP_UNMARSHALL:
706 valp = NDS_MALLOC(nds, n_alloc, outer_ref);
707 if (!valp) {
708 NDR_SET_ERROR(outer_ref, NDR_ERR_MALLOC_FAILED);
709 return (0);
710 }
711 if (outer_ref->backptr)
712 *outer_ref->backptr = valp;
713 outer_ref->datum = valp;
714 break;
715
716 default:
717 NDR_SET_ERROR(outer_ref, NDR_ERR_M_OP_INVALID);
718 return (0);
719 }
720
721 bzero(&myref, sizeof (myref));
722 myref.stream = nds;
723 myref.enclosing = outer_ref;
724 myref.ti = outer_ref->ti;
725 myref.datum = outer_ref->datum;
726 myref.name = "FIXED-VALUE";
727 myref.outer_flags = NDR_F_NONE;
728 myref.inner_flags = NDR_F_NONE;
729
730 myref.pdu_offset = outer_ref->pdu_offset;
731 outer_ref->pdu_end_offset = outer_ref->pdu_offset + n_pdu_total;
732
733 rc = ndr_inner(&myref);
734 if (!rc)
735 return (rc); /* error already set */
736
737 nds->pdu_scan_offset = outer_ref->pdu_end_offset;
738 return (1);
739 }
740
741 int
742 ndr_outer_fixed_array(ndr_ref_t *outer_ref)
743 {
744 ndr_stream_t *nds = outer_ref->stream;
745 ndr_typeinfo_t *ti = outer_ref->ti;
746 ndr_ref_t myref;
747 char *valp = NULL;
748 int is_varlen = ti->pdu_size_variable_part;
749 int is_union = NDR_IS_UNION(ti);
750 int is_string = NDR_IS_STRING(ti);
751 int rc;
752 unsigned n_hdr;
753 unsigned n_fixed;
754 unsigned n_variable;
755 unsigned n_alloc;
756 unsigned n_pdu_total;
757 int params;
758
759 params = outer_ref->outer_flags & NDR_F_PARAMS_MASK;
760
761 assert(!is_varlen && !is_string && !is_union);
762 assert(params == NDR_F_DIMENSION_IS);
763
764 /* no header for this */
765 n_hdr = 0;
766
767 /* fixed part -- exactly dimension_is of these */
768 n_fixed = ti->pdu_size_fixed_part * outer_ref->dimension_is;
769 assert(n_fixed > 0);
770
771 /* variable part -- exactly none of these */
772 n_variable = 0;
773
774 /* sum them up to determine the PDU space required */
775 n_pdu_total = n_hdr + n_fixed + n_variable;
776
777 /* similar sum to determine how much local memory is required */
778 n_alloc = n_fixed + n_variable;
779
780 rc = ndr_outer_grow(outer_ref, n_pdu_total);
781 if (!rc)
782 return (rc); /* error already set */
783
784 switch (nds->m_op) {
785 case NDR_M_OP_MARSHALL:
786 valp = outer_ref->datum;
787 if (!valp) {
788 NDR_SET_ERROR(outer_ref, NDR_ERR_OUTER_PARAMS_BAD);
789 return (0);
790 }
791 if (outer_ref->backptr)
792 assert(valp == *outer_ref->backptr);
793 break;
794
795 case NDR_M_OP_UNMARSHALL:
796 valp = NDS_MALLOC(nds, n_alloc, outer_ref);
797 if (!valp) {
798 NDR_SET_ERROR(outer_ref, NDR_ERR_MALLOC_FAILED);
799 return (0);
800 }
801 if (outer_ref->backptr)
802 *outer_ref->backptr = valp;
803 outer_ref->datum = valp;
804 break;
805
806 default:
807 NDR_SET_ERROR(outer_ref, NDR_ERR_M_OP_INVALID);
808 return (0);
809 }
810
811 bzero(&myref, sizeof (myref));
812 myref.stream = nds;
813 myref.enclosing = outer_ref;
814 myref.ti = outer_ref->ti;
815 myref.datum = outer_ref->datum;
816 myref.name = "FIXED-ARRAY";
817 myref.outer_flags = NDR_F_NONE;
818 myref.inner_flags = NDR_F_DIMENSION_IS;
819 myref.dimension_is = outer_ref->dimension_is;
820
821 myref.pdu_offset = outer_ref->pdu_offset;
822 outer_ref->pdu_end_offset = outer_ref->pdu_offset + n_pdu_total;
823
824 rc = ndr_inner(&myref);
825 if (!rc)
826 return (rc); /* error already set */
827
828 nds->pdu_scan_offset = outer_ref->pdu_end_offset;
829 return (1);
830 }
831
832 int
833 ndr_outer_conformant_array(ndr_ref_t *outer_ref)
834 {
835 ndr_stream_t *nds = outer_ref->stream;
836 ndr_typeinfo_t *ti = outer_ref->ti;
837 ndr_ref_t myref;
838 char *valp = NULL;
839 int is_varlen = ti->pdu_size_variable_part;
840 int is_union = NDR_IS_UNION(ti);
841 int is_string = NDR_IS_STRING(ti);
842 unsigned long size_is;
843 int rc;
844 unsigned n_hdr;
845 unsigned n_fixed;
846 unsigned n_variable;
847 unsigned n_alloc;
848 unsigned n_pdu_total;
849 unsigned n_ptr_offset;
850 int params;
851
852 params = outer_ref->outer_flags & NDR_F_PARAMS_MASK;
853
854 assert(!is_varlen && !is_string && !is_union);
855 assert(params & NDR_F_SIZE_IS);
856
857 /* conformant header for this */
858 n_hdr = 4;
859
860 /* fixed part -- exactly none of these */
861 n_fixed = 0;
862
863 /* variable part -- exactly size_of of these */
864 /* notice that it is the **fixed** size of the ti */
865 n_variable = ti->pdu_size_fixed_part * outer_ref->size_is;
866
867 /* sum them up to determine the PDU space required */
868 n_pdu_total = n_hdr + n_fixed + n_variable;
869
870 /* similar sum to determine how much local memory is required */
871 n_alloc = n_fixed + n_variable;
872
873 rc = ndr_outer_grow(outer_ref, n_pdu_total);
874 if (!rc)
875 return (rc); /* error already set */
876
877 switch (nds->m_op) {
878 case NDR_M_OP_MARSHALL:
879 size_is = outer_ref->size_is;
880 rc = ndr_outer_poke_sizing(outer_ref, 0, &size_is);
881 if (!rc)
882 return (0); /* error already set */
883
884 valp = outer_ref->datum;
885 if (!valp) {
886 NDR_SET_ERROR(outer_ref, NDR_ERR_OUTER_PARAMS_BAD);
887 return (0);
888 }
889 if (outer_ref->backptr)
890 assert(valp == *outer_ref->backptr);
891 n_ptr_offset = 4;
892 break;
893
894 case NDR_M_OP_UNMARSHALL:
895 if (params & NDR_F_IS_REFERENCE) {
896 size_is = outer_ref->size_is;
897 n_ptr_offset = 0;
898 } else {
899 /* NDR_F_IS_POINTER */
900 rc = ndr_outer_peek_sizing(outer_ref, 0, &size_is);
901 if (!rc)
902 return (0); /* error already set */
903
904 if (size_is != outer_ref->size_is) {
905 NDR_SET_ERROR(outer_ref,
906 NDR_ERR_SIZE_IS_MISMATCH_PDU);
907 return (0);
908 }
909
910 n_ptr_offset = 4;
911 }
912
913 if (size_is > 0) {
914 valp = NDS_MALLOC(nds, n_alloc, outer_ref);
915 if (!valp) {
916 NDR_SET_ERROR(outer_ref, NDR_ERR_MALLOC_FAILED);
917 return (0);
918 }
919 }
920
921 if (outer_ref->backptr)
922 *outer_ref->backptr = valp;
923 outer_ref->datum = valp;
924 break;
925
926 default:
927 NDR_SET_ERROR(outer_ref, NDR_ERR_M_OP_INVALID);
928 return (0);
929 }
930
931 outer_ref->pdu_end_offset = outer_ref->pdu_offset + n_pdu_total;
932 outer_ref->type_flags = NDR_F_NONE;
933 outer_ref->inner_flags = NDR_F_NONE;
934
935 if (size_is > 0) {
936 bzero(&myref, sizeof (myref));
937 myref.stream = nds;
938 myref.enclosing = outer_ref;
939 myref.ti = outer_ref->ti;
940 myref.datum = outer_ref->datum;
941 myref.name = "CONFORMANT-ARRAY";
942 myref.outer_flags = NDR_F_NONE;
943 myref.inner_flags = NDR_F_SIZE_IS;
944 myref.size_is = outer_ref->size_is;
945
946 myref.inner_flags = NDR_F_DIMENSION_IS; /* convenient */
947 myref.dimension_is = outer_ref->size_is; /* convenient */
948
949 myref.pdu_offset = outer_ref->pdu_offset + n_ptr_offset;
950
951 rc = ndr_inner(&myref);
952 if (!rc)
953 return (rc); /* error already set */
954 }
955
956 nds->pdu_scan_offset = outer_ref->pdu_end_offset;
957 return (1);
958 }
959
960 int
961 ndr_outer_conformant_construct(ndr_ref_t *outer_ref)
962 {
963 ndr_stream_t *nds = outer_ref->stream;
964 ndr_typeinfo_t *ti = outer_ref->ti;
965 ndr_ref_t myref;
966 char *valp = NULL;
967 int is_varlen = ti->pdu_size_variable_part;
968 int is_union = NDR_IS_UNION(ti);
969 int is_string = NDR_IS_STRING(ti);
970 unsigned long size_is;
971 int rc;
972 unsigned n_hdr;
973 unsigned n_fixed;
974 unsigned n_variable;
975 unsigned n_alloc;
976 unsigned n_pdu_total;
977 int params;
978
979 params = outer_ref->outer_flags & NDR_F_PARAMS_MASK;
980
981 assert(is_varlen && !is_string && !is_union);
982 assert(params == NDR_F_NONE);
983
984 /* conformant header for this */
985 n_hdr = 4;
986
987 /* fixed part -- exactly one of these */
988 n_fixed = ti->pdu_size_fixed_part;
989
990 /* variable part -- exactly size_of of these */
991 n_variable = 0; /* 0 for the moment */
992
993 /* sum them up to determine the PDU space required */
994 n_pdu_total = n_hdr + n_fixed + n_variable;
995
996 /* similar sum to determine how much local memory is required */
997 n_alloc = n_fixed + n_variable;
998
999 /* For the moment, grow enough for the fixed-size part */
1000 rc = ndr_outer_grow(outer_ref, n_pdu_total);
1001 if (!rc)
1002 return (rc); /* error already set */
1003
1004 switch (nds->m_op) {
1005 case NDR_M_OP_MARSHALL:
1006 /*
1007 * We don't know the size yet. We have to wait for
1008 * it. Proceed with the fixed-size part, and await
1009 * the call to ndr_size_is().
1010 */
1011 size_is = 0;
1012 rc = ndr_outer_poke_sizing(outer_ref, 0, &size_is);
1013 if (!rc)
1014 return (0); /* error already set */
1015
1016 valp = outer_ref->datum;
1017 if (!valp) {
1018 NDR_SET_ERROR(outer_ref, NDR_ERR_OUTER_PARAMS_BAD);
1019 return (0);
1020 }
1021 if (outer_ref->backptr)
1022 assert(valp == *outer_ref->backptr);
1023 break;
1024
1025 case NDR_M_OP_UNMARSHALL:
1026 /*
1027 * We know the size of the variable part because
1028 * of the CONFORMANT header. We will verify
1029 * the header against the [size_is(X)] advice
1030 * later when ndr_size_is() is called.
1031 */
1032 rc = ndr_outer_peek_sizing(outer_ref, 0, &size_is);
1033 if (!rc)
1034 return (0); /* error already set */
1035
1036 /* recalculate metrics */
1037 n_variable = size_is * ti->pdu_size_variable_part;
1038 n_pdu_total = n_hdr + n_fixed + n_variable;
1039 n_alloc = n_fixed + n_variable;
1040
1041 rc = ndr_outer_grow(outer_ref, n_pdu_total);
1042 if (!rc)
1043 return (rc); /* error already set */
1044
1045 outer_ref->size_is = size_is; /* verified later */
1046
1047 valp = NDS_MALLOC(nds, n_alloc, outer_ref);
1048 if (!valp) {
1049 NDR_SET_ERROR(outer_ref, NDR_ERR_MALLOC_FAILED);
1050 return (0);
1051 }
1052 if (outer_ref->backptr)
1053 *outer_ref->backptr = valp;
1054 outer_ref->datum = valp;
1055 break;
1056
1057 default:
1058 NDR_SET_ERROR(outer_ref, NDR_ERR_M_OP_INVALID);
1059 return (0);
1060 }
1061
1062 outer_ref->pdu_end_offset = outer_ref->pdu_offset + n_pdu_total;
1063 outer_ref->type_flags = NDR_F_SIZE_IS; /* indicate pending */
1064 outer_ref->inner_flags = NDR_F_NONE; /* indicate pending */
1065
1066 bzero(&myref, sizeof (myref));
1067 myref.stream = nds;
1068 myref.enclosing = outer_ref;
1069 myref.ti = outer_ref->ti;
1070 myref.datum = outer_ref->datum;
1071 myref.name = "CONFORMANT-CONSTRUCT";
1072 myref.outer_flags = NDR_F_NONE;
1073 myref.inner_flags = NDR_F_NONE;
1074 myref.size_is = outer_ref->size_is;
1075
1076 myref.pdu_offset = outer_ref->pdu_offset + 4;
1077
1078 rc = ndr_inner(&myref);
1079 if (!rc)
1080 return (rc); /* error already set */
1081
1082 nds->pdu_scan_offset = outer_ref->pdu_end_offset;
1083
1084 if (outer_ref->inner_flags != NDR_F_SIZE_IS) {
1085 NDR_SET_ERROR(&myref, NDR_ERR_SIZE_IS_MISMATCH_AFTER);
1086 return (0);
1087 }
1088
1089 return (1);
1090 }
1091
1092 int
1093 ndr_size_is(ndr_ref_t *ref)
1094 {
1095 ndr_stream_t *nds = ref->stream;
1096 ndr_ref_t *outer_ref = nds->outer_current;
1097 ndr_typeinfo_t *ti = outer_ref->ti;
1098 unsigned long size_is;
1099 int rc;
1100 unsigned n_hdr;
1101 unsigned n_fixed;
1102 unsigned n_variable;
1103 unsigned n_pdu_total;
1104
1105 assert(ref->inner_flags & NDR_F_SIZE_IS);
1106 size_is = ref->size_is;
1107
1108 if (outer_ref->type_flags != NDR_F_SIZE_IS) {
1109 NDR_SET_ERROR(ref, NDR_ERR_SIZE_IS_UNEXPECTED);
1110 return (0);
1111 }
1112
1113 if (outer_ref->inner_flags & NDR_F_SIZE_IS) {
1114 NDR_SET_ERROR(ref, NDR_ERR_SIZE_IS_DUPLICATED);
1115 return (0);
1116 }
1117
1118 /* repeat metrics, see ndr_conformant_construct() above */
1119 n_hdr = 4;
1120 n_fixed = ti->pdu_size_fixed_part;
1121 n_variable = size_is * ti->pdu_size_variable_part;
1122 n_pdu_total = n_hdr + n_fixed + n_variable;
1123
1124 rc = ndr_outer_grow(outer_ref, n_pdu_total);
1125 if (!rc)
1126 return (rc); /* error already set */
1127
1128 switch (nds->m_op) {
1129 case NDR_M_OP_MARSHALL:
1130 /*
1131 * We have to set the sizing header and extend
1132 * the size of the PDU (already done).
1133 */
1134 rc = ndr_outer_poke_sizing(outer_ref, 0, &size_is);
1135 if (!rc)
1136 return (0); /* error already set */
1137 break;
1138
1139 case NDR_M_OP_UNMARSHALL:
1140 /*
1141 * Allocation done during ndr_conformant_construct().
1142 * All we are doing here is verifying that the
1143 * intended size (ref->size_is) matches the sizing header.
1144 */
1145 if (size_is != outer_ref->size_is) {
1146 NDR_SET_ERROR(ref, NDR_ERR_SIZE_IS_MISMATCH_PDU);
1147 return (0);
1148 }
1149 break;
1150
1151 default:
1152 NDR_SET_ERROR(outer_ref, NDR_ERR_M_OP_INVALID);
1153 return (0);
1154 }
1155
1156 outer_ref->inner_flags |= NDR_F_SIZE_IS;
1157 outer_ref->size_is = ref->size_is;
1158 return (1);
1159 }
1160
1161 int
1162 ndr_outer_string(ndr_ref_t *outer_ref)
1163 {
1164 ndr_stream_t *nds = outer_ref->stream;
1165 ndr_typeinfo_t *ti = outer_ref->ti;
1166 ndr_ref_t myref;
1167 char *valp = NULL;
1168 unsigned is_varlen = ti->pdu_size_variable_part;
1169 int is_union = NDR_IS_UNION(ti);
1170 int is_string = NDR_IS_STRING(ti);
1171 int rc;
1172 unsigned n_zeroes;
1173 unsigned ix;
1174 unsigned long size_is;
1175 unsigned long first_is;
1176 unsigned long length_is;
1177 unsigned n_hdr;
1178 unsigned n_fixed;
1179 unsigned n_variable;
1180 unsigned n_alloc;
1181 unsigned n_pdu_total;
1182 int params;
1183
1184 params = outer_ref->outer_flags & NDR_F_PARAMS_MASK;
1185
1186 assert(is_varlen && is_string && !is_union);
1187 assert(params == NDR_F_NONE);
1188
1189 /* string header for this: size_is first_is length_is */
1190 n_hdr = 12;
1191
1192 /* fixed part -- exactly none of these */
1193 n_fixed = 0;
1194
1195 if (!ndr_outer_grow(outer_ref, n_hdr))
1196 return (0); /* error already set */
1197
1198 switch (nds->m_op) {
1199 case NDR_M_OP_MARSHALL:
1200 valp = outer_ref->datum;
1201 if (!valp) {
1202 NDR_SET_ERROR(outer_ref, NDR_ERR_OUTER_PARAMS_BAD);
1203 return (0);
1204 }
1205
1206 if (outer_ref->backptr)
1207 assert(valp == *outer_ref->backptr);
1208
1209 if (ti == &ndt_s_wchar) {
1210 /*
1211 * size_is is the number of characters in the
1212 * (multibyte) string, including the null.
1213 */
1214 size_is = smb_wcequiv_strlen(valp) /
1215 sizeof (smb_wchar_t);
1216
1217 if (!(nds->flags & NDS_F_NONULL))
1218 ++size_is;
1219
1220 if (size_is > NDR_STRING_MAX) {
1221 NDR_SET_ERROR(outer_ref, NDR_ERR_STRLEN);
1222 return (0);
1223 }
1224 } else {
1225 valp = outer_ref->datum;
1226 n_zeroes = 0;
1227 for (ix = 0; ix < NDR_STRING_MAX; ix++) {
1228 if (valp[ix] == 0) {
1229 n_zeroes++;
1230 if (n_zeroes >= is_varlen &&
1231 ix % is_varlen == 0) {
1232 break;
1233 }
1234 } else {
1235 n_zeroes = 0;
1236 }
1237 }
1238 if (ix >= NDR_STRING_MAX) {
1239 NDR_SET_ERROR(outer_ref, NDR_ERR_STRLEN);
1240 return (0);
1241 }
1242 size_is = ix+1;
1243 }
1244
1245 first_is = 0;
1246
1247 if (nds->flags & NDS_F_NOTERM)
1248 length_is = size_is - 1;
1249 else
1250 length_is = size_is;
1251
1252 if (!ndr_outer_poke_sizing(outer_ref, 0, &size_is) ||
1253 !ndr_outer_poke_sizing(outer_ref, 4, &first_is) ||
1254 !ndr_outer_poke_sizing(outer_ref, 8, &length_is))
1255 return (0); /* error already set */
1256 break;
1257
1258 case NDR_M_OP_UNMARSHALL:
1259 if (!ndr_outer_peek_sizing(outer_ref, 0, &size_is) ||
1260 !ndr_outer_peek_sizing(outer_ref, 4, &first_is) ||
1261 !ndr_outer_peek_sizing(outer_ref, 8, &length_is))
1262 return (0); /* error already set */
1263
1264 /*
1265 * In addition to the first_is check, we used to check that
1266 * size_is or size_is-1 was equal to length_is but Windows95
1267 * doesn't conform to this "rule" (see variable part below).
1268 * The srvmgr tool for Windows95 sent the following values
1269 * for a path string:
1270 *
1271 * size_is = 261 (0x105)
1272 * first_is = 0
1273 * length_is = 53 (0x35)
1274 *
1275 * The length_is was correct (for the given path) but the
1276 * size_is was the maximum path length rather than being
1277 * related to length_is.
1278 */
1279 if (first_is != 0) {
1280 NDR_SET_ERROR(outer_ref, NDR_ERR_STRING_SIZING);
1281 return (0);
1282 }
1283
1284 if (ti == &ndt_s_wchar) {
1285 /*
1286 * Decoding Unicode to UTF-8; we need to allow
1287 * for the maximum possible char size. It would
1288 * be nice to use mbequiv_strlen but the string
1289 * may not be null terminated.
1290 */
1291 n_alloc = (size_is + 1) * MTS_MB_CHAR_MAX;
1292 } else {
1293 n_alloc = (size_is + 1) * is_varlen;
1294 }
1295
1296 valp = NDS_MALLOC(nds, n_alloc, outer_ref);
1297 if (!valp) {
1298 NDR_SET_ERROR(outer_ref, NDR_ERR_MALLOC_FAILED);
1299 return (0);
1300 }
1301
1302 bzero(valp, (size_is+1) * is_varlen);
1303
1304 if (outer_ref->backptr)
1305 *outer_ref->backptr = valp;
1306 outer_ref->datum = valp;
1307 break;
1308
1309 default:
1310 NDR_SET_ERROR(outer_ref, NDR_ERR_M_OP_INVALID);
1311 return (0);
1312 }
1313
1314 /*
1315 * Variable part - exactly length_is of these.
1316 *
1317 * Usually, length_is is same as size_is and includes nul.
1318 * Some protocols use length_is = size_is-1, and length_is does
1319 * not include the nul (which is more consistent with DCE spec).
1320 * If the length_is is 0, there is no data following the
1321 * sizing header, regardless of size_is.
1322 */
1323 n_variable = length_is * is_varlen;
1324
1325 /* sum them up to determine the PDU space required */
1326 n_pdu_total = n_hdr + n_fixed + n_variable;
1327
1328 /* similar sum to determine how much local memory is required */
1329 n_alloc = n_fixed + n_variable;
1330
1331 rc = ndr_outer_grow(outer_ref, n_pdu_total);
1332 if (!rc)
1333 return (rc); /* error already set */
1334
1335 if (length_is > 0) {
1336 bzero(&myref, sizeof (myref));
1337 myref.stream = nds;
1338 myref.enclosing = outer_ref;
1339 myref.ti = outer_ref->ti;
1340 myref.datum = outer_ref->datum;
1341 myref.name = "OUTER-STRING";
1342 myref.outer_flags = NDR_F_IS_STRING;
1343 myref.inner_flags = NDR_F_NONE;
1344
1345 /*
1346 * Set up size_is and strlen_is for ndr_s_wchar.
1347 */
1348 myref.size_is = size_is;
1349 myref.strlen_is = length_is;
1350 }
1351
1352 myref.pdu_offset = outer_ref->pdu_offset + 12;
1353
1354 /*
1355 * Don't try to decode empty strings.
1356 */
1357 if ((size_is == 0) && (first_is == 0) && (length_is == 0)) {
1358 nds->pdu_scan_offset = outer_ref->pdu_end_offset;
1359 return (1);
1360 }
1361
1362 if ((size_is != 0) && (length_is != 0)) {
1363 rc = ndr_inner(&myref);
1364 if (!rc)
1365 return (rc); /* error already set */
1366 }
1367
1368 nds->pdu_scan_offset = outer_ref->pdu_end_offset;
1369 return (1);
1370 }
1371
1372 int
1373 ndr_outer_peek_sizing(ndr_ref_t *outer_ref, unsigned offset,
1374 unsigned long *sizing_p)
1375 {
1376 ndr_stream_t *nds = outer_ref->stream;
1377 unsigned long pdu_offset;
1378 int rc;
1379
1380 pdu_offset = outer_ref->pdu_offset + offset;
1381
1382 if (pdu_offset < nds->outer_current->pdu_offset ||
1383 pdu_offset > nds->outer_current->pdu_end_offset ||
1384 pdu_offset+4 > nds->outer_current->pdu_end_offset) {
1385 NDR_SET_ERROR(outer_ref, NDR_ERR_BOUNDS_CHECK);
1386 return (0);
1387 }
1388
1389 switch (nds->m_op) {
1390 case NDR_M_OP_MARSHALL:
1391 NDR_SET_ERROR(outer_ref, NDR_ERR_UNIMPLEMENTED);
1392 return (0);
1393
1394 case NDR_M_OP_UNMARSHALL:
1395 rc = NDS_GET_PDU(nds, pdu_offset, 4, (char *)sizing_p,
1396 nds->swap, outer_ref);
1397 break;
1398
1399 default:
1400 NDR_SET_ERROR(outer_ref, NDR_ERR_M_OP_INVALID);
1401 return (0);
1402 }
1403
1404 return (rc);
1405 }
1406
1407 int
1408 ndr_outer_poke_sizing(ndr_ref_t *outer_ref, unsigned offset,
1409 unsigned long *sizing_p)
1410 {
1411 ndr_stream_t *nds = outer_ref->stream;
1412 unsigned long pdu_offset;
1413 int rc;
1414
1415 pdu_offset = outer_ref->pdu_offset + offset;
1416
1417 if (pdu_offset < nds->outer_current->pdu_offset ||
1418 pdu_offset > nds->outer_current->pdu_end_offset ||
1419 pdu_offset+4 > nds->outer_current->pdu_end_offset) {
1420 NDR_SET_ERROR(outer_ref, NDR_ERR_BOUNDS_CHECK);
1421 return (0);
1422 }
1423
1424 switch (nds->m_op) {
1425 case NDR_M_OP_MARSHALL:
1426 rc = NDS_PUT_PDU(nds, pdu_offset, 4, (char *)sizing_p,
1427 nds->swap, outer_ref);
1428 break;
1429
1430 case NDR_M_OP_UNMARSHALL:
1431 NDR_SET_ERROR(outer_ref, NDR_ERR_UNIMPLEMENTED);
1432 return (0);
1433
1434 default:
1435 NDR_SET_ERROR(outer_ref, NDR_ERR_M_OP_INVALID);
1436 return (0);
1437 }
1438
1439 return (rc);
1440 }
1441
1442 /*
1443 * All OUTER constructs begin on a mod4 (dword) boundary - except
1444 * for the ones that don't: some MSRPC calls appear to use word or
1445 * packed alignment. Strings appear to be dword aligned.
1446 */
1447 int
1448 ndr_outer_align(ndr_ref_t *outer_ref)
1449 {
1450 ndr_stream_t *nds = outer_ref->stream;
1451 int rc;
1452 unsigned n_pad;
1453 unsigned align;
1454
1455 if (outer_ref->packed_alignment && outer_ref->ti != &ndt_s_wchar) {
1456 align = outer_ref->ti->alignment;
1457 n_pad = ((align + 1) - nds->pdu_scan_offset) & align;
1458 } else {
1459 n_pad = NDR_ALIGN4(nds->pdu_scan_offset);
1460 }
1461
1462 if (n_pad == 0)
1463 return (1); /* already aligned, often the case */
1464
1465 if (!ndr_outer_grow(outer_ref, n_pad))
1466 return (0); /* error already set */
1467
1468 switch (nds->m_op) {
1469 case NDR_M_OP_MARSHALL:
1470 rc = NDS_PAD_PDU(nds, nds->pdu_scan_offset, n_pad, outer_ref);
1471 if (!rc) {
1472 NDR_SET_ERROR(outer_ref, NDR_ERR_PAD_FAILED);
1473 return (0);
1474 }
1475 break;
1476
1477 case NDR_M_OP_UNMARSHALL:
1478 break;
1479
1480 default:
1481 NDR_SET_ERROR(outer_ref, NDR_ERR_M_OP_INVALID);
1482 return (0);
1483 }
1484
1485 nds->pdu_scan_offset += n_pad;
1486 return (1);
1487 }
1488
1489 int
1490 ndr_outer_grow(ndr_ref_t *outer_ref, unsigned n_total)
1491 {
1492 ndr_stream_t *nds = outer_ref->stream;
1493 unsigned long pdu_want_size;
1494 int rc, is_ok = 0;
1495
1496 pdu_want_size = nds->pdu_scan_offset + n_total;
1497
1498 if (pdu_want_size <= nds->pdu_max_size) {
1499 is_ok = 1;
1500 }
1501
1502 switch (nds->m_op) {
1503 case NDR_M_OP_MARSHALL:
1504 if (is_ok)
1505 break;
1506 rc = NDS_GROW_PDU(nds, pdu_want_size, outer_ref);
1507 if (!rc) {
1508 NDR_SET_ERROR(outer_ref, NDR_ERR_GROW_FAILED);
1509 return (0);
1510 }
1511 break;
1512
1513 case NDR_M_OP_UNMARSHALL:
1514 if (is_ok)
1515 break;
1516 NDR_SET_ERROR(outer_ref, NDR_ERR_UNDERFLOW);
1517 return (0);
1518
1519 default:
1520 NDR_SET_ERROR(outer_ref, NDR_ERR_M_OP_INVALID);
1521 return (0);
1522 }
1523
1524 if (nds->pdu_size < pdu_want_size)
1525 nds->pdu_size = pdu_want_size;
1526
1527 outer_ref->pdu_end_offset = pdu_want_size;
1528 return (1);
1529 }
1530
1531 /*
1532 * INNER ELEMENTS
1533 *
1534 * The local datum (arg_ref->datum) already exists, there is no need to
1535 * malloc() it. The datum should point at a member of a structure.
1536 *
1537 * For the most part, ndr_inner() and its helpers are just a sanity
1538 * check. The underlying ti->ndr_func() could be called immediately
1539 * for non-pointer elements. For the sake of robustness, we detect
1540 * run-time errors here. Most of the situations this protects against
1541 * have already been checked by the IDL compiler. This is also a
1542 * common point for processing of all data, and so is a convenient
1543 * place to work from for debugging.
1544 */
1545 int
1546 ndr_inner(ndr_ref_t *arg_ref)
1547 {
1548 ndr_typeinfo_t *ti = arg_ref->ti;
1549 int is_varlen = ti->pdu_size_variable_part;
1550 int is_union = NDR_IS_UNION(ti);
1551 int error = NDR_ERR_INNER_PARAMS_BAD;
1552 int params;
1553
1554 params = arg_ref->inner_flags & NDR_F_PARAMS_MASK;
1555
1556 switch (params) {
1557 case NDR_F_NONE:
1558 if (is_union) {
1559 error = NDR_ERR_SWITCH_VALUE_MISSING;
1560 break;
1561 }
1562 return (*ti->ndr_func)(arg_ref);
1563
1564 case NDR_F_SIZE_IS:
1565 case NDR_F_DIMENSION_IS:
1566 case NDR_F_IS_POINTER+NDR_F_SIZE_IS: /* pointer to something */
1567 case NDR_F_IS_REFERENCE+NDR_F_SIZE_IS: /* pointer to something */
1568 if (is_varlen) {
1569 error = NDR_ERR_ARRAY_VARLEN_ILLEGAL;
1570 break;
1571 }
1572 if (is_union) {
1573 error = NDR_ERR_ARRAY_UNION_ILLEGAL;
1574 break;
1575 }
1576 if (params & NDR_F_IS_POINTER)
1577 return (ndr_inner_pointer(arg_ref));
1578 else if (params & NDR_F_IS_REFERENCE)
1579 return (ndr_inner_reference(arg_ref));
1580 else
1581 return (ndr_inner_array(arg_ref));
1582
1583 case NDR_F_IS_POINTER: /* type is pointer to one something */
1584 if (is_union) {
1585 error = NDR_ERR_ARRAY_UNION_ILLEGAL;
1586 break;
1587 }
1588 return (ndr_inner_pointer(arg_ref));
1589
1590 case NDR_F_IS_REFERENCE: /* type is pointer to one something */
1591 if (is_union) {
1592 error = NDR_ERR_ARRAY_UNION_ILLEGAL;
1593 break;
1594 }
1595 return (ndr_inner_reference(arg_ref));
1596
1597 case NDR_F_SWITCH_IS:
1598 if (!is_union) {
1599 error = NDR_ERR_SWITCH_VALUE_ILLEGAL;
1600 break;
1601 }
1602 return (*ti->ndr_func)(arg_ref);
1603
1604 default:
1605 error = NDR_ERR_INNER_PARAMS_BAD;
1606 break;
1607 }
1608
1609 /*
1610 * If we get here, something is wrong. Most likely,
1611 * the params flags do not match
1612 */
1613 NDR_SET_ERROR(arg_ref, error);
1614 return (0);
1615 }
1616
1617 int
1618 ndr_inner_pointer(ndr_ref_t *arg_ref)
1619 {
1620 ndr_stream_t *nds = arg_ref->stream;
1621 /*LINTED E_BAD_PTR_CAST_ALIGN*/
1622 char **valpp = (char **)arg_ref->datum;
1623 ndr_ref_t *outer_ref;
1624
1625 if (!ndr__ulong(arg_ref))
1626 return (0); /* error */
1627 if (!*valpp)
1628 return (1); /* NULL pointer */
1629
1630 outer_ref = ndr_enter_outer_queue(arg_ref);
1631 if (!outer_ref)
1632 return (0); /* error already set */
1633
1634 /*
1635 * Move advice in inner_flags to outer_flags.
1636 * Retain pointer flag for conformant arrays.
1637 */
1638 outer_ref->outer_flags = arg_ref->inner_flags & NDR_F_PARAMS_MASK;
1639 if ((outer_ref->outer_flags & NDR_F_SIZE_IS) == 0)
1640 outer_ref->outer_flags &= ~NDR_F_IS_POINTER;
1641 #ifdef NDR_INNER_PTR_NOT_YET
1642 outer_ref->outer_flags |= NDR_F_BACKPTR;
1643 if (outer_ref->outer_flags & NDR_F_SIZE_IS) {
1644 outer_ref->outer_flags |= NDR_F_ARRAY+NDR_F_CONFORMANT;
1645 }
1646 #endif /* NDR_INNER_PTR_NOT_YET */
1647
1648 outer_ref->backptr = valpp;
1649
1650 switch (nds->m_op) {
1651 case NDR_M_OP_MARSHALL:
1652 outer_ref->datum = *valpp;
1653 break;
1654
1655 case NDR_M_OP_UNMARSHALL:
1656 /*
1657 * This is probably wrong if the application allocated
1658 * memory in advance. Indicate no value for now.
1659 * ONC RPC handles this case.
1660 */
1661 *valpp = 0;
1662 outer_ref->datum = 0;
1663 break;
1664 }
1665
1666 return (1); /* pointer dereference scheduled */
1667 }
1668
1669 int
1670 ndr_inner_reference(ndr_ref_t *arg_ref)
1671 {
1672 ndr_stream_t *nds = arg_ref->stream;
1673 /*LINTED E_BAD_PTR_CAST_ALIGN*/
1674 char **valpp = (char **)arg_ref->datum;
1675 ndr_ref_t *outer_ref;
1676
1677 outer_ref = ndr_enter_outer_queue(arg_ref);
1678 if (!outer_ref)
1679 return (0); /* error already set */
1680
1681 /*
1682 * Move advice in inner_flags to outer_flags.
1683 * Retain reference flag for conformant arrays.
1684 */
1685 outer_ref->outer_flags = arg_ref->inner_flags & NDR_F_PARAMS_MASK;
1686 if ((outer_ref->outer_flags & NDR_F_SIZE_IS) == 0)
1687 outer_ref->outer_flags &= ~NDR_F_IS_REFERENCE;
1688 #ifdef NDR_INNER_REF_NOT_YET
1689 outer_ref->outer_flags |= NDR_F_BACKPTR;
1690 if (outer_ref->outer_flags & NDR_F_SIZE_IS) {
1691 outer_ref->outer_flags |= NDR_F_ARRAY+NDR_F_CONFORMANT;
1692 }
1693 #endif /* NDR_INNER_REF_NOT_YET */
1694
1695 outer_ref->backptr = valpp;
1696
1697 switch (nds->m_op) {
1698 case NDR_M_OP_MARSHALL:
1699 outer_ref->datum = *valpp;
1700 break;
1701
1702 case NDR_M_OP_UNMARSHALL:
1703 /*
1704 * This is probably wrong if the application allocated
1705 * memory in advance. Indicate no value for now.
1706 * ONC RPC handles this case.
1707 */
1708 *valpp = 0;
1709 outer_ref->datum = 0;
1710 break;
1711 }
1712
1713 return (1); /* pointer dereference scheduled */
1714 }
1715
1716 int
1717 ndr_inner_array(ndr_ref_t *encl_ref)
1718 {
1719 ndr_typeinfo_t *ti = encl_ref->ti;
1720 ndr_ref_t myref;
1721 unsigned long pdu_offset = encl_ref->pdu_offset;
1722 unsigned long n_elem;
1723 unsigned long i;
1724 char name[30];
1725
1726 if (encl_ref->inner_flags & NDR_F_SIZE_IS) {
1727 /* now is the time to check/set size */
1728 if (!ndr_size_is(encl_ref))
1729 return (0); /* error already set */
1730 n_elem = encl_ref->size_is;
1731 } else {
1732 assert(encl_ref->inner_flags & NDR_F_DIMENSION_IS);
1733 n_elem = encl_ref->dimension_is;
1734 }
1735
1736 bzero(&myref, sizeof (myref));
1737 myref.enclosing = encl_ref;
1738 myref.stream = encl_ref->stream;
1739 myref.packed_alignment = 0;
1740 myref.ti = ti;
1741 myref.inner_flags = NDR_F_NONE;
1742
1743 for (i = 0; i < n_elem; i++) {
1744 (void) sprintf(name, "[%lu]", i);
1745 myref.name = name;
1746 myref.pdu_offset = pdu_offset + i * ti->pdu_size_fixed_part;
1747 myref.datum = encl_ref->datum + i * ti->c_size_fixed_part;
1748
1749 if (!ndr_inner(&myref))
1750 return (0);
1751 }
1752
1753 return (1);
1754 }
1755
1756
1757 /*
1758 * BASIC TYPES
1759 */
1760 #define MAKE_BASIC_TYPE_BASE(TYPE, SIZE) \
1761 extern int ndr_##TYPE(struct ndr_reference *encl_ref); \
1762 ndr_typeinfo_t ndt_##TYPE = { \
1763 1, /* NDR version */ \
1764 (SIZE)-1, /* alignment */ \
1765 NDR_F_NONE, /* flags */ \
1766 ndr_##TYPE, /* ndr_func */ \
1767 SIZE, /* pdu_size_fixed_part */ \
1768 0, /* pdu_size_variable_part */ \
1769 SIZE, /* c_size_fixed_part */ \
1770 0, /* c_size_variable_part */ \
1771 }; \
1772 int ndr_##TYPE(struct ndr_reference *ref) { \
1773 return (ndr_basic_integer(ref, SIZE)); \
1774 }
1775
1776 #define MAKE_BASIC_TYPE_STRING(TYPE, SIZE) \
1777 extern int ndr_s##TYPE(struct ndr_reference *encl_ref); \
1778 ndr_typeinfo_t ndt_s##TYPE = { \
1779 1, /* NDR version */ \
1780 (SIZE)-1, /* alignment */ \
1781 NDR_F_STRING, /* flags */ \
1782 ndr_s##TYPE, /* ndr_func */ \
1783 0, /* pdu_size_fixed_part */ \
1784 SIZE, /* pdu_size_variable_part */ \
1785 0, /* c_size_fixed_part */ \
1786 SIZE, /* c_size_variable_part */ \
1787 }; \
1788 int ndr_s##TYPE(struct ndr_reference *ref) { \
1789 return (ndr_string_basic_integer(ref, &ndt_##TYPE)); \
1790 }
1791
1792 #define MAKE_BASIC_TYPE(TYPE, SIZE) \
1793 MAKE_BASIC_TYPE_BASE(TYPE, SIZE) \
1794 MAKE_BASIC_TYPE_STRING(TYPE, SIZE)
1795
1796 int ndr_basic_integer(ndr_ref_t *, unsigned);
1797 int ndr_string_basic_integer(ndr_ref_t *, ndr_typeinfo_t *);
1798
1799
1800 MAKE_BASIC_TYPE(_char, 1)
1801 MAKE_BASIC_TYPE(_uchar, 1)
1802 MAKE_BASIC_TYPE(_short, 2)
1803 MAKE_BASIC_TYPE(_ushort, 2)
1804 MAKE_BASIC_TYPE(_long, 4)
1805 MAKE_BASIC_TYPE(_ulong, 4)
1806
1807 MAKE_BASIC_TYPE_BASE(_wchar, 2)
1808
1809 int
1810 ndr_basic_integer(ndr_ref_t *ref, unsigned size)
1811 {
1812 ndr_stream_t *nds = ref->stream;
1813 char *valp = (char *)ref->datum;
1814 int rc;
1815
1816 switch (nds->m_op) {
1817 case NDR_M_OP_MARSHALL:
1818 rc = NDS_PUT_PDU(nds, ref->pdu_offset, size,
1819 valp, nds->swap, ref);
1820 break;
1821
1822 case NDR_M_OP_UNMARSHALL:
1823 rc = NDS_GET_PDU(nds, ref->pdu_offset, size,
1824 valp, nds->swap, ref);
1825 break;
1826
1827 default:
1828 NDR_SET_ERROR(ref, NDR_ERR_M_OP_INVALID);
1829 return (0);
1830 }
1831
1832 return (rc);
1833 }
1834
1835 int
1836 ndr_string_basic_integer(ndr_ref_t *encl_ref, ndr_typeinfo_t *type_under)
1837 {
1838 unsigned long pdu_offset = encl_ref->pdu_offset;
1839 unsigned size = type_under->pdu_size_fixed_part;
1840 char *valp;
1841 ndr_ref_t myref;
1842 unsigned long i;
1843 long sense = 0;
1844 char name[30];
1845
1846 assert(size != 0);
1847
1848 bzero(&myref, sizeof (myref));
1849 myref.enclosing = encl_ref;
1850 myref.stream = encl_ref->stream;
1851 myref.packed_alignment = 0;
1852 myref.ti = type_under;
1853 myref.inner_flags = NDR_F_NONE;
1854 myref.name = name;
1855
1856 for (i = 0; i < NDR_STRING_MAX; i++) {
1857 (void) sprintf(name, "[%lu]", i);
1858 myref.pdu_offset = pdu_offset + i * size;
1859 valp = encl_ref->datum + i * size;
1860 myref.datum = valp;
1861
1862 if (!ndr_inner(&myref))
1863 return (0);
1864
1865 switch (size) {
1866 case 1: sense = *valp; break;
1867 /*LINTED E_BAD_PTR_CAST_ALIGN*/
1868 case 2: sense = *(short *)valp; break;
1869 /*LINTED E_BAD_PTR_CAST_ALIGN*/
1870 case 4: sense = *(long *)valp; break;
1871 }
1872
1873 if (!sense)
1874 break;
1875 }
1876
1877 return (1);
1878 }
1879
1880
1881 extern int ndr_s_wchar(ndr_ref_t *encl_ref);
1882 ndr_typeinfo_t ndt_s_wchar = {
1883 1, /* NDR version */
1884 2-1, /* alignment */
1885 NDR_F_STRING, /* flags */
1886 ndr_s_wchar, /* ndr_func */
1887 0, /* pdu_size_fixed_part */
1888 2, /* pdu_size_variable_part */
1889 0, /* c_size_fixed_part */
1890 1, /* c_size_variable_part */
1891 };
1892
1893
1894 /*
1895 * Hand coded wchar function because all strings are transported
1896 * as wide characters. During NDR_M_OP_MARSHALL, we convert from
1897 * multi-byte to wide characters. During NDR_M_OP_UNMARSHALL, we
1898 * convert from wide characters to multi-byte.
1899 *
1900 * It appeared that NT would sometimes leave a spurious character
1901 * in the data stream before the null wide_char, which would get
1902 * included in the string decode because we processed until the
1903 * null character. It now looks like NT does not always terminate
1904 * RPC Unicode strings and the terminating null is a side effect
1905 * of field alignment. So now we rely on the strlen_is (set up in
1906 * ndr_outer_string) of the enclosing reference. This may or may
1907 * not include the null but it doesn't matter, the algorithm will
1908 * get it right.
1909 */
1910 int
1911 ndr_s_wchar(ndr_ref_t *encl_ref)
1912 {
1913 ndr_stream_t *nds = encl_ref->stream;
1914 unsigned short wide_char;
1915 char *valp;
1916 ndr_ref_t myref;
1917 unsigned long i;
1918 char name[30];
1919 int count;
1920 int char_count = 0;
1921
1922 if (nds->m_op == NDR_M_OP_UNMARSHALL) {
1923 /*
1924 * To avoid problems with zero length strings
1925 * we can just null terminate here and be done.
1926 */
1927 if (encl_ref->strlen_is == 0) {
1928 encl_ref->datum[0] = '\0';
1929 return (1);
1930 }
1931 }
1932
1933 bzero(&myref, sizeof (myref));
1934 myref.enclosing = encl_ref;
1935 myref.stream = encl_ref->stream;
1936 myref.packed_alignment = 0;
1937 myref.ti = &ndt__wchar;
1938 myref.inner_flags = NDR_F_NONE;
1939 myref.datum = (char *)&wide_char;
1940 myref.name = name;
1941 myref.pdu_offset = encl_ref->pdu_offset;
1942
1943 valp = encl_ref->datum;
1944 count = 0;
1945
1946 for (i = 0; i < NDR_STRING_MAX; i++) {
1947 (void) sprintf(name, "[%lu]", i);
1948
1949 if (nds->m_op == NDR_M_OP_MARSHALL) {
1950 count = smb_mbtowc((smb_wchar_t *)&wide_char, valp,
1951 MTS_MB_CHAR_MAX);
1952 if (count < 0) {
1953 return (0);
1954 } else if (count == 0) {
1955 if (encl_ref->strlen_is != encl_ref->size_is)
1956 break;
1957
1958 /*
1959 * If the input char is 0, mbtowc
1960 * returns 0 without setting wide_char.
1961 * Set wide_char to 0 and a count of 1.
1962 */
1963 wide_char = *valp;
1964 count = 1;
1965 }
1966 }
1967
1968 if (!ndr_inner(&myref))
1969 return (0);
1970
1971 if (nds->m_op == NDR_M_OP_UNMARSHALL) {
1972 count = smb_wctomb(valp, wide_char);
1973
1974 if ((++char_count) == encl_ref->strlen_is) {
1975 valp += count;
1976 *valp = '\0';
1977 break;
1978 }
1979 }
1980
1981 if (!wide_char)
1982 break;
1983
1984 myref.pdu_offset += sizeof (wide_char);
1985 valp += count;
1986 }
1987
1988 return (1);
1989 }
1990
1991 /*
1992 * Converts a multibyte character string to a little-endian, wide-char
1993 * string. No more than nwchars wide characters are stored.
1994 * A terminating null wide character is appended if there is room.
1995 *
1996 * Returns the number of wide characters converted, not counting
1997 * any terminating null wide character. Returns -1 if an invalid
1998 * multibyte character is encountered.
1999 */
2000 size_t
2001 ndr_mbstowcs(ndr_stream_t *nds, smb_wchar_t *wcs, const char *mbs,
2002 size_t nwchars)
2003 {
2004 smb_wchar_t *start = wcs;
2005 int nbytes;
2006
2007 while (nwchars--) {
2008 nbytes = ndr_mbtowc(nds, wcs, mbs, MTS_MB_CHAR_MAX);
2009 if (nbytes < 0) {
2010 *wcs = 0;
2011 return ((size_t)-1);
2012 }
2013
2014 if (*mbs == 0)
2015 break;
2016
2017 ++wcs;
2018 mbs += nbytes;
2019 }
2020
2021 return (wcs - start);
2022 }
2023
2024 /*
2025 * Converts a multibyte character to a little-endian, wide-char, which
2026 * is stored in wcharp. Up to nbytes bytes are examined.
2027 *
2028 * If mbchar is valid, returns the number of bytes processed in mbchar.
2029 * If mbchar is invalid, returns -1. See also smb_mbtowc().
2030 */
2031 /*ARGSUSED*/
2032 int
2033 ndr_mbtowc(ndr_stream_t *nds, smb_wchar_t *wcharp, const char *mbchar,
2034 size_t nbytes)
2035 {
2036 int rc;
2037
2038 if ((rc = smb_mbtowc(wcharp, mbchar, nbytes)) < 0)
2039 return (rc);
2040
2041 #ifdef _BIG_ENDIAN
2042 if (nds == NULL || NDR_MODE_MATCH(nds, NDR_MODE_RETURN_SEND))
2043 *wcharp = BSWAP_16(*wcharp);
2044 #endif
2045
2046 return (rc);
2047 }