Fix andx offset calculation for more than 2 chained requests

Untested code is broken code.... Test follows later, it's quite an intrusive
change to libsmb/

diff --git a/source/smbd/process.c b/source/smbd/process.c
index da1165219b52c537f29a6c6bbeff3a65822e3448..a1d2d88b3ddc482873f109dd56b01f0f4f65ea33 100644 (file)
--- a/source/smbd/process.c
+++ b/source/smbd/process.c
@@ -1696,7 +1696,7 @@ void chain_reply(struct smb_request *req)
         * remember how much the caller added to the chain, only counting
         * stuff after the parameter words
         */
-       chain_size += outsize_padded - smb_wct;
+       chain_size += (outsize_padded - smb_wct);
 
        /*
         * work out pointers into the original packets. The
@@ -1825,6 +1825,12 @@ void chain_reply(struct smb_request *req)
        SAFE_FREE(caller_output);
        TALLOC_FREE(req2);
 
+       /*
+        * Reset the chain_size for our caller's offset calculations
+        */
+
+       chain_size -= (outsize_padded - smb_wct);
+
        return;
 }