Hi all,
Hello Jeremy,

this is the 1st of some bugs reports, I plan to send in the near future:

All file refs are based on todays svn rev 11296.

Description:
When using the os/2 workplaceshell (WPS) to copy a whole subdir (a folder)
to a samba3 share, the WPS displays a dialog box "The parameter is incorrect." 
and the copy is aborted.

In file smbd/trans.c -> function call_trans2setfilepathinfo() near line
3738 a check is made for the passed total_data size:
                case SMB_INFO_SET_EA:
                {
                        struct ea_list *ea_list = NULL;
                        TALLOC_CTX *ctx = NULL;

                        if (total_data < 10) {
                                return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
                        }

If total_data < 10, an error is flagged.
This assumption is _not_ always valid!

Some Background:
When os/2 calls DosSetPathInfo(), it first has to prepare 
an EAOP2 data structure. 

 typedef struct _EAOP2 {
   PGEA2LIST     fpGEA2List;  /*  GEA set. */
   PFEA2LIST     fpFEA2List;  /*  FEA set. */
   ULONG         oError;      /*  Offset of FEA error. */
 } EAOP2;

In our case PGEA2LIST is set NULL and PFEA2LIST must point to a
(usually) properly created FEA2LIST data area:

typedef struct _FEA2LIST {
   ULONG     cbList;   /*  Total bytes of structure including full list. */
   FEA2      list[1];  /*  Variable-length FEA2 structures. */
} FEA2LIST;

The point of interest here is, that _usually_ FEA2LIST must contain
at least _one_ FEA2 structure, as defined as the "list" struct member above.

So the struct member "cbList" must usually at least contain the value 10,
if an eaname with 1 char (plus following nul char) is used.

typedef struct _FEA2 {
   ULONG      oNextEntryOffset;  /*  Offset to next entry. */
   BYTE       fEA;               /*  Extended attributes flag. */
     /* 0 (not critical EA) or FEA_NEEDEA */
   BYTE       cbName;            /*  Length of szName, not including NULL. */
   USHORT     cbValue;           /*  Value length. */
   CHAR       szName[1];         /*  Extended attribute name. */
} FEA2;
The member "oNextEntryOffset" is not put onto the wire, so a valid FEA2
struct with an eaname of "A\0" has a size of 6 bytes, plus the size of
"cbList" itself from FEA2LIST, the minimum size on the wire seems to be 10!

BUT - the WPS (at least) uses a strange variation of this!
I have not seen any docu about that so far...!

The WPS simply sets "cbList" in FEA2LIST to a value of 4 (four), which
could friendly be interpreted as "no FEA2 stuff available at all". Huh.
And so a size of 4 is put onto the wire - and that SMB call should succeed!

So the sequence 
if (total_data < 10) {
     return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
}
must be expanded like:
if (total_data < 10) {
     if (total_data == 4) {
          /* special handling must be done */
          ....    /* to be filled in */
     } else {
          /* Hmm - maybe there are more special cases? */
          return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
     }
}

Jeremy, i coded a simple os2/2 test app, which does expose the bug and
the ethereal sniffs are _very_ short.
I will send 3 sniffs:
  - the failing one against samba3
  - an OK one taken against samba4
  - an OK one taken against w2k

I guess, when you look at the sniffs, it might be easy to code the
missing stuff.

Best wishes - Guenter