|
|
|
|
@ -1139,7 +1139,9 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
|
|
|
|
|
parsed += retval;
|
|
|
|
|
input_len -= retval;
|
|
|
|
|
} else if (input_len) {
|
|
|
|
|
SCLogDebug("Error Parsing DCERPC %s", (dcerpc->dcerpchdr.type == BIND) ? "BIND" : "ALTER_CONTEXT");
|
|
|
|
|
SCLogDebug("Error Parsing DCERPC %s",
|
|
|
|
|
(dcerpc->dcerpchdr.type == BIND) ?
|
|
|
|
|
"BIND" : "ALTER_CONTEXT");
|
|
|
|
|
parsed = 0;
|
|
|
|
|
input_len = 0;
|
|
|
|
|
}
|
|
|
|
|
@ -1158,7 +1160,8 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
|
|
|
|
|
input_len -= retval;
|
|
|
|
|
SCLogDebug("BIND processed %u/%u ctxitems %u/%u input_len left %u\n",
|
|
|
|
|
dcerpc->bytesprocessed,
|
|
|
|
|
dcerpc->dcerpchdr.frag_length, dcerpc->dcerpcbindbindack.numctxitemsleft,
|
|
|
|
|
dcerpc->dcerpchdr.frag_length,
|
|
|
|
|
dcerpc->dcerpcbindbindack.numctxitemsleft,
|
|
|
|
|
dcerpc->dcerpcbindbindack.numctxitems, input_len);
|
|
|
|
|
} else if (input_len) {
|
|
|
|
|
//parsed -= input_len;
|
|
|
|
|
@ -1184,9 +1187,12 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
|
|
|
|
|
parsed += retval;
|
|
|
|
|
input_len -= retval;
|
|
|
|
|
SCLogDebug("DCERPCParseBINDACK processed %u/%u input_len left %u",
|
|
|
|
|
dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len);
|
|
|
|
|
dcerpc->bytesprocessed,
|
|
|
|
|
dcerpc->dcerpchdr.frag_length, input_len);
|
|
|
|
|
} else if (input_len) {
|
|
|
|
|
SCLogDebug("Error parsing %s\n", (dcerpc->dcerpchdr.type == BIND_ACK) ? "BIND_ACK" : "ALTER_CONTEXT_RESP");
|
|
|
|
|
SCLogDebug("Error parsing %s\n",
|
|
|
|
|
(dcerpc->dcerpchdr.type == BIND_ACK) ?
|
|
|
|
|
"BIND_ACK" : "ALTER_CONTEXT_RESP");
|
|
|
|
|
parsed = 0;
|
|
|
|
|
input_len = 0;
|
|
|
|
|
}
|
|
|
|
|
@ -1199,8 +1205,7 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
|
|
|
|
|
if (retval) {
|
|
|
|
|
parsed += retval;
|
|
|
|
|
input_len -= retval;
|
|
|
|
|
SCLogDebug(
|
|
|
|
|
"DCERPCParseSecondaryAddr %u/%u left %u secondaryaddr len(%u)",
|
|
|
|
|
SCLogDebug("DCERPCParseSecondaryAddr %u/%u left %u secondaryaddr len(%u)",
|
|
|
|
|
dcerpc->bytesprocessed, dcerpc->dcerpchdr.frag_length, input_len,
|
|
|
|
|
dcerpc->dcerpcbindbindack.secondaryaddrlen);
|
|
|
|
|
} else if (input_len) {
|
|
|
|
|
@ -1274,7 +1279,8 @@ int32_t DCERPCParser(DCERPC *dcerpc, uint8_t *input, uint32_t input_len) {
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
SCLogDebug("BINDACK processed %u/%u input_len left %u", dcerpc->bytesprocessed,
|
|
|
|
|
SCLogDebug("BINDACK processed %u/%u input_len left %u",
|
|
|
|
|
dcerpc->bytesprocessed,
|
|
|
|
|
dcerpc->dcerpchdr.frag_length, input_len);
|
|
|
|
|
if (dcerpc->bytesprocessed == dcerpc->dcerpchdr.frag_length) {
|
|
|
|
|
dcerpc->bytesprocessed = 0;
|
|
|
|
|
|