aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

minor fixes in endianness handling in dcerpc and dce detection engine

Browse Source
remotes/origin/master-1.1.x
Anoop Saldanha 15 years ago committed by Victor Julien
parent acfc9a8ab0
commit b4427e81ec
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File

6
src/app-layer-dcerpc.c
Unescape Escape View File

@ -1047,7 +1047,7 @@ static uint32_t DCERPCParseREQUEST(DCERPC *dcerpc, uint8_t *input, uint32_t inpu
case 21: case 21:
/* context id 2 */ /* context id 2 */
dcerpc->dcerpcrequest.ctxid |= *(p++) << 8; dcerpc->dcerpcrequest.ctxid |= *(p++) << 8;
if (dcerpc->dcerpchdr.packed_drep[0] == 0x00) { if (!(dcerpc->dcerpchdr.packed_drep[0] & 0x10)) {
dcerpc->dcerpcrequest.ctxid = SCByteSwap16(dcerpc->dcerpcrequest.ctxid); dcerpc->dcerpcrequest.ctxid = SCByteSwap16(dcerpc->dcerpcrequest.ctxid);
} }
dcerpc->dcerpcrequest.first_request_seen = 1; dcerpc->dcerpcrequest.first_request_seen = 1;
@ -1064,7 +1064,7 @@ static uint32_t DCERPCParseREQUEST(DCERPC *dcerpc, uint8_t *input, uint32_t inpu
case 23: case 23:
if (dcerpc->dcerpchdr.type == REQUEST) { if (dcerpc->dcerpchdr.type == REQUEST) {
dcerpc->dcerpcrequest.opnum |= *(p++) << 8; dcerpc->dcerpcrequest.opnum |= *(p++) << 8;
if (dcerpc->dcerpchdr.packed_drep[0] == 0x00) { if (!(dcerpc->dcerpchdr.packed_drep[0] & 0x10)) {
dcerpc->dcerpcrequest.opnum = SCByteSwap16(dcerpc->dcerpcrequest.opnum); dcerpc->dcerpcrequest.opnum = SCByteSwap16(dcerpc->dcerpcrequest.opnum);
} }
} else { } else {
@ -1288,7 +1288,7 @@ static int DCERPCParseHeader(DCERPC *dcerpc, uint8_t *input, uint32_t input_len)
break; break;
case 15: case 15:
dcerpc->dcerpchdr.call_id |= *(p++) << 24; dcerpc->dcerpchdr.call_id |= *(p++) << 24;
if (dcerpc->dcerpchdr.packed_drep[0] == 0x00) { if (!(dcerpc->dcerpchdr.packed_drep[0] & 0x10)) {
dcerpc->dcerpchdr.frag_length = SCByteSwap16(dcerpc->dcerpchdr.frag_length); dcerpc->dcerpchdr.frag_length = SCByteSwap16(dcerpc->dcerpchdr.frag_length);
dcerpc->dcerpchdr.auth_length = SCByteSwap16(dcerpc->dcerpchdr.auth_length); dcerpc->dcerpchdr.auth_length = SCByteSwap16(dcerpc->dcerpchdr.auth_length);
dcerpc->dcerpchdr.call_id = SCByteSwap32(dcerpc->dcerpchdr.call_id); dcerpc->dcerpchdr.call_id = SCByteSwap32(dcerpc->dcerpchdr.call_id);

4
src/detect-engine-dcepayload.c
Unescape Escape View File

@ -383,7 +383,7 @@ static int DoInspectDcePayload(DetectEngineCtx *de_ctx,
if (flags & DETECT_BYTETEST_DCE) { if (flags & DETECT_BYTETEST_DCE) {
/* enable the endianness flag temporarily. once we are done /* enable the endianness flag temporarily. once we are done
* processing we reset the flags to the original value*/ * processing we reset the flags to the original value*/
flags |= ((dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] == 0x10) ? flags |= ((dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] & 0x10) ?
DETECT_BYTETEST_LITTLE: 0); DETECT_BYTETEST_LITTLE: 0);
} }
@ -408,7 +408,7 @@ static int DoInspectDcePayload(DetectEngineCtx *de_ctx,
if (flags & DETECT_BYTEJUMP_DCE) { if (flags & DETECT_BYTEJUMP_DCE) {
/* enable the endianness flag temporarily. once we are done /* enable the endianness flag temporarily. once we are done
* processing we reset the flags to the original value*/ * processing we reset the flags to the original value*/
flags |= ((dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] == 0x10) ? flags |= ((dcerpc_state->dcerpc.dcerpchdr.packed_drep[0] & 0x10) ?
DETECT_BYTEJUMP_LITTLE : 0); DETECT_BYTEJUMP_LITTLE : 0);
} }

Write Preview
Loading…
Cancel
Save