From 25edac76661acc9a128a23271f763c425b3ff8f1 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Tue, 13 Jun 2017 08:39:16 +0200
Subject: [PATCH] nfs3: fill bytes corner case

---
 rust/src/nfs/nfs3.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rust/src/nfs/nfs3.rs b/rust/src/nfs/nfs3.rs
index b0152f22b8..7dc18e2907 100644
--- a/rust/src/nfs/nfs3.rs
+++ b/rust/src/nfs/nfs3.rs
@@ -1071,6 +1071,7 @@ impl NFS3State {
         if pad != 0 {
             fill_bytes = 4 - pad;
         }
+        SCLogDebug!("XID {} fill_bytes {} reply.count {} reply.data_len {} reply.data.len() {}", r.hdr.xid, fill_bytes, reply.count, reply.data_len, reply.data.len());
 
         if nfs_version == 2 {
             let size = match parse_nfs2_attribs(reply.attr_blob) {
@@ -1132,7 +1133,7 @@ impl NFS3State {
         //}
         if !self.is_udp {
             self.tc_chunk_xid = r.hdr.xid;
-            self.tc_chunk_left = reply.count as u32 - reply.data.len() as u32;
+            self.tc_chunk_left = (reply.count as u32 + fill_bytes) - reply.data.len() as u32;
         }
 
         SCLogDebug!("REPLY {} to procedure {} blob size {} / {}: chunk_left {}",