func:  CVE_2009_1439_VULN_CIFSTCon(unsigned int xid, struct cifsSesInfo const char *tree, struct cifsTconInfo const struct nls_table *nls_codepage) struct smb_hdr * smb_buffer ; TCONX_REQ * pSMB ; unsigned char * bcc_ptr ; if ( ses == NULL )  smb_buffer = cifs_buf_get ( ); if ( smb_buffer == NULL )  smb_buffer -> Mid = GetNextMid ( ses -> server ); smb_buffer -> Uid = ses -> Suid; pSMB = ( TCONX_REQ * ) smb_buffer; pSMB -> AndXCommand = 0xFF; pSMB -> Flags = cpu_to_le16 ( TCON_EXTENDED_SECINFO ); bcc_ptr = & pSMB -> Password [ 0 ]; if ( ( ses -> server -> secMode ) & SECMODE_USER )  * bcc_ptr = 0; bcc_ptr ++; bcc_ptr += CIFS_SESS_KEY_SIZE; if ( ses -> capabilities & CAP_UNICODE )  * bcc_ptr = 0; bcc_ptr ++; if ( ses -> capabilities & CAP_UNICODE )  strcpy ( bcc_ptr , tree ); bcc_ptr += strlen ( tree ) + 1; strcpy ( bcc_ptr , "?????" ); bcc_ptr += strlen ( "?????" ); bcc_ptr += 1; count = bcc_ptr - & pSMB -> Password [ 0 ]; pSMB -> hdr . smb_buf_length += count; pSMB -> ByteCount = cpu_to_le16 ( count ); length = strnlen ( bcc_ptr , BCC ( smb_buffer_response ) - 2 ); if ( length == 3 )  if ( ( bcc_ptr [ 0 ] == 'I' ) && ( bcc_ptr [ 1 ] == 'P' ) && ( bcc_ptr [ 2 ] == 'C' ) )  if ( length == 2 )  if ( ( bcc_ptr [ 0 ] == 'A' ) && ( bcc_ptr [ 1 ] == ':' ) )  bcc_ptr += length + 1; length = UniStrnlen ( ( wchar_t * ) bcc_ptr , 512 ); if ( ( bcc_ptr + ( 2 * length ) ) - pByteArea ( smb_buffer_response ) <= BCC ( smb_buffer_response ) )  tcon -> nativeFileSystem = kzalloc ( length + 2 , GFP_KERNEL ); if ( tcon -> nativeFileSystem )  cifs_strfromUCS_le ( tcon -> nativeFileSystem , ( __le16 * ) bcc_ptr , length , nls_codepage ); bcc_ptr += 2 * length; bcc_ptr [ 0 ] = 0; bcc_ptr [ 1 ] = 0; bcc_ptr += 2; length = strnlen ( bcc_ptr , 1024 ); if ( ( bcc_ptr + length ) - pByteArea ( smb_buffer_response ) <= BCC ( smb_buffer_response ) )  tcon -> nativeFileSystem = kzalloc ( length + 1 , GFP_KERNEL ); if ( tcon -> nativeFileSystem )  strncpy ( tcon -> nativeFileSystem , bcc_ptr , length ); tcon -> Flags = le16_to_cpu ( pSMBr -> OptionalSupport ); cFYI ( 1 , ( "Tcon flags: 0x%x " , tcon -> Flags ) ); 