ses->serverOS = kcalloc(1, len + 1,GFP_KERNEL); 
ses->serverOS = kzalloc(len + 1,GFP_KERNEL); 
CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,	      char session_key[CIFS_SESSION_KEY_SIZE],	      const struct nls_table *nls_codepage){	struct smb_hdr *smb_buffer;	struct smb_hdr *smb_buffer_response;	SESSION_SETUP_ANDX *pSMB;	SESSION_SETUP_ANDX *pSMBr;	char *bcc_ptr;	char *user;	char *domain;	int rc = 0;	int remaining_words = 0;	int bytes_returned = 0;	int len;	__u32 capabilities;	__u16 count;	cFYI(1, ("In sesssetup "));	if(ses == NULL)		return -EINVAL;	user = ses->userName;	domain = ses->domainName;	smb_buffer = cifs_buf_get();	if (smb_buffer == NULL) {		return -ENOMEM;	}	smb_buffer_response = smb_buffer;	pSMBr = pSMB = (SESSION_SETUP_ANDX *) smb_buffer;	/* send SMBsessionSetup here */	header_assemble(smb_buffer, SMB_COM_SESSION_SETUP_ANDX,			NULL /* no tCon exists yet */ , 13 /* wct */ );	pSMB->req_no_secext.AndXCommand = 0xFF;	pSMB->req_no_secext.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);	pSMB->req_no_secext.MaxMpxCount = cpu_to_le16(ses->server->maxReq);	if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))		smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;	capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |		CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;	if (ses->capabilities & CAP_UNICODE) {		smb_buffer->Flags2 |= SMBFLG2_UNICODE;		capabilities |= CAP_UNICODE;	}	if (ses->capabilities & CAP_STATUS32) {		smb_buffer->Flags2 |= SMBFLG2_ERR_STATUS;		capabilities |= CAP_STATUS32;	}	if (ses->capabilities & CAP_DFS) {		smb_buffer->Flags2 |= SMBFLG2_DFS;		capabilities |= CAP_DFS;	}	pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);	pSMB->req_no_secext.CaseInsensitivePasswordLength = 		cpu_to_le16(CIFS_SESSION_KEY_SIZE);	pSMB->req_no_secext.CaseSensitivePasswordLength =	    cpu_to_le16(CIFS_SESSION_KEY_SIZE);	bcc_ptr = pByteArea(smb_buffer);	memcpy(bcc_ptr, (char *) session_key, CIFS_SESSION_KEY_SIZE);	bcc_ptr += CIFS_SESSION_KEY_SIZE;	memcpy(bcc_ptr, (char *) session_key, CIFS_SESSION_KEY_SIZE);	bcc_ptr += CIFS_SESSION_KEY_SIZE;	if (ses->capabilities & CAP_UNICODE) {		if ((long) bcc_ptr % 2) { /* must be word aligned for Unicode */			*bcc_ptr = 0;			bcc_ptr++;		}		if(user == NULL)			bytes_returned = 0; /* skill null user */	        else			bytes_returned =			        cifs_strtoUCS((wchar_t *) bcc_ptr, user, 100,					nls_codepage);		/* convert number of 16 bit words to bytes */		bcc_ptr += 2 * bytes_returned;		bcc_ptr += 2;	/* trailing null */		if (domain == NULL)			bytes_returned =			    cifs_strtoUCS((wchar_t *) bcc_ptr,					  "CIFS_LINUX_DOM", 32, nls_codepage);		else			bytes_returned =			    cifs_strtoUCS((wchar_t *) bcc_ptr, domain, 64,					  nls_codepage);		bcc_ptr += 2 * bytes_returned;		bcc_ptr += 2;		bytes_returned =		    cifs_strtoUCS((wchar_t *) bcc_ptr, "Linux version ",				  32, nls_codepage);		bcc_ptr += 2 * bytes_returned;		bytes_returned =		    cifs_strtoUCS((wchar_t *) bcc_ptr, system_utsname.release,				  32, nls_codepage);		bcc_ptr += 2 * bytes_returned;		bcc_ptr += 2;		bytes_returned =		    cifs_strtoUCS((wchar_t *) bcc_ptr, CIFS_NETWORK_OPSYS,				  64, nls_codepage);		bcc_ptr += 2 * bytes_returned;		bcc_ptr += 2;	} else {		if(user != NULL) {                		    strncpy(bcc_ptr, user, 200);		    bcc_ptr += strnlen(user, 200);		}		*bcc_ptr = 0;		bcc_ptr++;		if (domain == NULL) {			strcpy(bcc_ptr, "CIFS_LINUX_DOM");			bcc_ptr += strlen("CIFS_LINUX_DOM") + 1;		} else {			strncpy(bcc_ptr, domain, 64);			bcc_ptr += strnlen(domain, 64);			*bcc_ptr = 0;			bcc_ptr++;		}		strcpy(bcc_ptr, "Linux version ");		bcc_ptr += strlen("Linux version ");		strcpy(bcc_ptr, system_utsname.release);		bcc_ptr += strlen(system_utsname.release) + 1;		strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);		bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;	}	count = (long) bcc_ptr - (long) pByteArea(smb_buffer);	smb_buffer->smb_buf_length += count;	pSMB->req_no_secext.ByteCount = cpu_to_le16(count);	rc = SendReceive(xid, ses, smb_buffer, smb_buffer_response,			 &bytes_returned, 1);	if (rc) {/* rc = map_smb_to_linux_error(smb_buffer_response); now done in SendReceive */	} else if ((smb_buffer_response->WordCount == 3)		   || (smb_buffer_response->WordCount == 4)) {		__u16 action = le16_to_cpu(pSMBr->resp.Action);		__u16 blob_len = le16_to_cpu(pSMBr->resp.SecurityBlobLength);		if (action & GUEST_LOGIN)			cFYI(1, (" Guest login"));	/* do we want to mark SesInfo struct ? */		ses->Suid = smb_buffer_response->Uid;	/* UID left in wire format (le) */		cFYI(1, ("UID = %d ", ses->Suid));         /* response can have either 3 or 4 word count - Samba sends 3 */		bcc_ptr = pByteArea(smb_buffer_response);			if ((pSMBr->resp.hdr.WordCount == 3)		    || ((pSMBr->resp.hdr.WordCount == 4)			&& (blob_len < pSMBr->resp.ByteCount))) {			if (pSMBr->resp.hdr.WordCount == 4)				bcc_ptr += blob_len;			if (smb_buffer->Flags2 & SMBFLG2_UNICODE) {				if ((long) (bcc_ptr) % 2) {					remaining_words =					    (BCC(smb_buffer_response) - 1) /2;					bcc_ptr++;	/* Unicode strings must be word aligned */				} else {					remaining_words =						BCC(smb_buffer_response) / 2;				}				len =				    UniStrnlen((wchar_t *) bcc_ptr,					       remaining_words - 1);/* We look for obvious messed up bcc or strings in response so we do not go off   the end since (at least) WIN2K and Windows XP have a major bug in not null   terminating last Unicode string in response  */				ses->serverOS = kcalloc(1, 2 * (len + 1), GFP_KERNEL);				if(ses->serverOS == NULL)					goto sesssetup_nomem;				cifs_strfromUCS_le(ses->serverOS,					   (wchar_t *)bcc_ptr, len,nls_codepage);				bcc_ptr += 2 * (len + 1);				remaining_words -= len + 1;				ses->serverOS[2 * len] = 0;				ses->serverOS[1 + (2 * len)] = 0;				if (remaining_words > 0) {					len = UniStrnlen((wchar_t *)bcc_ptr,							 remaining_words-1);					ses->serverNOS = kcalloc(1, 2 * (len + 1),GFP_KERNEL);					if(ses->serverNOS == NULL)						goto sesssetup_nomem;					cifs_strfromUCS_le(ses->serverNOS,							   (wchar_t *)bcc_ptr,len,nls_codepage);					bcc_ptr += 2 * (len + 1);					ses->serverNOS[2 * len] = 0;					ses->serverNOS[1 + (2 * len)] = 0;					if(strncmp(ses->serverNOS,						"NT LAN Manager 4",16) == 0) {						cFYI(1,("NT4 server"));						ses->flags |= CIFS_SES_NT4;					}					remaining_words -= len + 1;					if (remaining_words > 0) {						len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);          /* last string is not always null terminated (for e.g. for Windows XP & 2000) */						ses->serverDomain =						    kcalloc(1, 2*(len+1),GFP_KERNEL);						if(ses->serverDomain == NULL)							goto sesssetup_nomem;						cifs_strfromUCS_le(ses->serverDomain,						     (wchar_t *)bcc_ptr,len,nls_codepage);						bcc_ptr += 2 * (len + 1);						ses->serverDomain[2*len] = 0;						ses->serverDomain[1+(2*len)] = 0;					} /* else no more room so create dummy domain string */					else						ses->serverDomain = 							kcalloc(1, 2, GFP_KERNEL);				} else {	/* no room so create dummy domain and NOS string */					/* if these kcallocs fail not much we					   can do, but better to not fail the					   sesssetup itself */					ses->serverDomain =					    kcalloc(1, 2, GFP_KERNEL);					ses->serverNOS =					    kcalloc(1, 2, GFP_KERNEL);				}			} else {	/* ASCII */				len = strnlen(bcc_ptr, 1024);				if (((long) bcc_ptr + len) - (long)				    pByteArea(smb_buffer_response)					    <= BCC(smb_buffer_response)) {					ses->serverOS = kcalloc(1, len + 1,GFP_KERNEL);					if(ses->serverOS == NULL)						goto sesssetup_nomem;					strncpy(ses->serverOS,bcc_ptr, len);					bcc_ptr += len;					bcc_ptr[0] = 0;	/* null terminate the string */					bcc_ptr++;					len = strnlen(bcc_ptr, 1024);					ses->serverNOS = kcalloc(1, len + 1,GFP_KERNEL);					if(ses->serverNOS == NULL)						goto sesssetup_nomem;					strncpy(ses->serverNOS, bcc_ptr, len);					bcc_ptr += len;					bcc_ptr[0] = 0;					bcc_ptr++;					len = strnlen(bcc_ptr, 1024);					ses->serverDomain = kcalloc(1, len + 1,GFP_KERNEL);					if(ses->serverDomain == NULL)						goto sesssetup_nomem;					strncpy(ses->serverDomain, bcc_ptr, len);					bcc_ptr += len;					bcc_ptr[0] = 0;					bcc_ptr++;				} else					cFYI(1,					     ("Variable field of length %d extends beyond end of smb ",					      len));			}		} else {			cERROR(1,			       (" Security Blob Length extends beyond end of SMB"));		}	} else {		cERROR(1,		       (" Invalid Word count %d: ",			smb_buffer_response->WordCount));		rc = -EIO;	}sesssetup_nomem:	/* do not return an error on nomem for the info strings,			   since that could make reconnection harder, and			   reconnection might be needed to free memory */	if (smb_buffer)		cifs_buf_release(smb_buffer);	return rc;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/e915fc497a8da551f32b7e5fda687eb4a10bc23b/connect.c/clean/fs/cifs/connect.c