http://lists.samba.org/archive/samba-technical/2007-April/052877.html
http://lists.samba.org/archive/samba-cvs/2007-April/075934.html

If the security is share then the inbuf data also includes the user
password. In this case before taking the path (service path) from inbuf,
the pointer should be increased by passlen + 1 (instead of passlen).

--- samba-3.0.24/source/smbd/reply.c	2007-02-05 04:09:01.000000000 +0900
+++ samba-3.0.24.osstech/source/smbd/reply.c	2007-05-08 01:11:06.933500911 +0900
@@ -639,13 +639,22 @@ int reply_tcon_and_X(connection_struct *
  
 	if (global_encrypted_passwords_negotiated) {
 		password = data_blob(smb_buf(inbuf),passlen);
+		if (lp_security() == SEC_SHARE) {
+			/*
+			 * Security = share always has a pad byte
+			 * after the password.
+			 */
+			p = smb_buf(inbuf) + passlen + 1;
+		} else {
+			p = smb_buf(inbuf) + passlen;
+		}
 	} else {
 		password = data_blob(smb_buf(inbuf),passlen+1);
 		/* Ensure correct termination */
-		password.data[passlen]=0;    
+		password.data[passlen]=0;
+		p = smb_buf(inbuf) + passlen + 1;
 	}
 
-	p = smb_buf(inbuf) + passlen;
 	p += srvstr_pull_buf(inbuf, path, p, sizeof(path), STR_TERMINATE);
 
 	/*