smb2_server: fix smbd_smb2_request_verify_sizes() for SMB2_OP_WRITE

Writes with a length of 0 are allowed.

The readfile related check we had before was not really useful
as min_dyn_len can only every be 0 or 1 (and for SMB2_OP_WRITE it's
always 1). So we checked
  if (unread_bytes > 0) {
     if (unread_bytes < 1) {
       return error;
     }
  }

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14361

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
index a4372bf114576d561457ef9efae4ea37c7de3b44..718f094153262a69eae1c1e87a4b2f06dded8810 100644 (file)
--- a/source3/smbd/smb2_server.c
+++ b/source3/smbd/smb2_server.c
@@ -2073,16 +2073,8 @@ NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
        switch (opcode) {
        case SMB2_OP_IOCTL:
        case SMB2_OP_GETINFO:
-               min_dyn_size = 0;
-               break;
        case SMB2_OP_WRITE:
-               if (req->smb1req != NULL && req->smb1req->unread_bytes > 0) {
-                       if (req->smb1req->unread_bytes < min_dyn_size) {
-                               return NT_STATUS_INVALID_PARAMETER;
-                       }
-
-                       min_dyn_size = 0;
-               }
+               min_dyn_size = 0;
                break;
        }