aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

dcerpc: improve integer handling

Browse Source
pull/2069/head
Victor Julien 9 years ago
parent 9235dd498f
commit ed5a01e8dd
2 changed files with 48 additions and 48 deletions
Show Stats Download Patch File Download Diff File

72
src/app-layer-dcerpc-udp.c
Unescape Escape View File

@ -196,18 +196,18 @@ static int DCERPCUDPParseHeader(Flow *f, void *dcerpcudp_state,
sstate->dcerpc.dcerpchdrudp.activityuuid[14] = *(p + 54);
sstate->dcerpc.dcerpchdrudp.activityuuid[15] = *(p + 55);
if (sstate->dcerpc.dcerpchdrudp.drep[0] == 0x10) {
sstate->dcerpc.dcerpchdrudp.server_boot = *(p + 56);
sstate->dcerpc.dcerpchdrudp.server_boot |= *(p + 57) << 8;
sstate->dcerpc.dcerpchdrudp.server_boot |= *(p + 58) << 16;
sstate->dcerpc.dcerpchdrudp.server_boot |= *(p + 59) << 24;
sstate->dcerpc.dcerpchdrudp.if_vers = *(p + 60);
sstate->dcerpc.dcerpchdrudp.if_vers |= *(p + 61) << 8;
sstate->dcerpc.dcerpchdrudp.if_vers |= *(p + 62) << 16;
sstate->dcerpc.dcerpchdrudp.if_vers |= *(p + 63) << 24;
sstate->dcerpc.dcerpchdrudp.seqnum = *(p + 64);
sstate->dcerpc.dcerpchdrudp.seqnum |= *(p + 65) << 8;
sstate->dcerpc.dcerpchdrudp.seqnum |= *(p + 66) << 16;
sstate->dcerpc.dcerpchdrudp.seqnum |= *(p + 67) << 24;
sstate->dcerpc.dcerpchdrudp.server_boot = (uint32_t) *(p + 56);
sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 57) << 8;
sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 58) << 16;
sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 59) << 24;
sstate->dcerpc.dcerpchdrudp.if_vers = (uint32_t) *(p + 60);
sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 61) << 8;
sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 62) << 16;
sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 63) << 24;
sstate->dcerpc.dcerpchdrudp.seqnum = (uint32_t) *(p + 64);
sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 65) << 8;
sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 66) << 16;
sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 67) << 24;
sstate->dcerpc.dcerpchdrudp.opnum = *(p + 68);
sstate->dcerpc.dcerpchdrudp.opnum |= *(p + 69) << 8;
sstate->dcerpc.dcerpchdrudp.ihint = *(p + 70);
@ -219,18 +219,18 @@ static int DCERPCUDPParseHeader(Flow *f, void *dcerpcudp_state,
sstate->dcerpc.dcerpchdrudp.fragnum = *(p + 76);
sstate->dcerpc.dcerpchdrudp.fragnum |= *(p + 77) << 8;
} else {
sstate->dcerpc.dcerpchdrudp.server_boot = *(p + 56) << 24;
sstate->dcerpc.dcerpchdrudp.server_boot |= *(p + 57) << 16;
sstate->dcerpc.dcerpchdrudp.server_boot |= *(p + 58) << 8;
sstate->dcerpc.dcerpchdrudp.server_boot |= *(p + 59);
sstate->dcerpc.dcerpchdrudp.if_vers = *(p + 60) << 24;
sstate->dcerpc.dcerpchdrudp.if_vers |= *(p + 61) << 16;
sstate->dcerpc.dcerpchdrudp.if_vers |= *(p + 62) << 8;
sstate->dcerpc.dcerpchdrudp.if_vers |= *(p + 63);
sstate->dcerpc.dcerpchdrudp.seqnum = *(p + 64) << 24;
sstate->dcerpc.dcerpchdrudp.seqnum |= *(p + 65) << 16;
sstate->dcerpc.dcerpchdrudp.seqnum |= *(p + 66) << 8;
sstate->dcerpc.dcerpchdrudp.seqnum |= *(p + 67);
sstate->dcerpc.dcerpchdrudp.server_boot = (uint32_t) *(p + 56) << 24;
sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 57) << 16;
sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 58) << 8;
sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p + 59);
sstate->dcerpc.dcerpchdrudp.if_vers = (uint32_t) *(p + 60) << 24;
sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 61) << 16;
sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 62) << 8;
sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p + 63);
sstate->dcerpc.dcerpchdrudp.seqnum = (uint32_t) *(p + 64) << 24;
sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 65) << 16;
sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 66) << 8;
sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p + 67);
sstate->dcerpc.dcerpchdrudp.opnum = *(p + 68) << 24;
sstate->dcerpc.dcerpchdrudp.opnum |= *(p + 69) << 16;
sstate->dcerpc.dcerpchdrudp.ihint = *(p + 70) << 8;
@ -553,62 +553,62 @@ static int DCERPCUDPParseHeader(Flow *f, void *dcerpcudp_state,
break;
/* fall through */
case 56:
sstate->dcerpc.dcerpchdrudp.server_boot = *(p++);
sstate->dcerpc.dcerpchdrudp.server_boot = (uint32_t) *(p++);
if (!(--input_len))
break;
/* fall through */
case 57:
sstate->dcerpc.dcerpchdrudp.server_boot |= *(p++) << 8;
sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p++) << 8;
if (!(--input_len))
break;
/* fall through */
case 58:
sstate->dcerpc.dcerpchdrudp.server_boot |= *(p++) << 16;
sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p++) << 16;
if (!(--input_len))
break;
/* fall through */
case 59:
sstate->dcerpc.dcerpchdrudp.server_boot |= *(p++) << 24;
sstate->dcerpc.dcerpchdrudp.server_boot |= (uint32_t) *(p++) << 24;
if (!(--input_len))
break;
/* fall through */
case 60:
sstate->dcerpc.dcerpchdrudp.if_vers = *(p++);
sstate->dcerpc.dcerpchdrudp.if_vers = (uint32_t) *(p++);
if (!(--input_len))
break;
/* fall through */
case 61:
sstate->dcerpc.dcerpchdrudp.if_vers |= *(p++) << 8;
sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p++) << 8;
if (!(--input_len))
break;
/* fall through */
case 62:
sstate->dcerpc.dcerpchdrudp.if_vers |= *(p++) << 16;
sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p++) << 16;
if (!(--input_len))
break;
/* fall through */
case 63:
sstate->dcerpc.dcerpchdrudp.if_vers |= *(p++) << 24;
sstate->dcerpc.dcerpchdrudp.if_vers |= (uint32_t) *(p++) << 24;
if (!(--input_len))
break;
/* fall through */
case 64:
sstate->dcerpc.dcerpchdrudp.seqnum = *(p++);
sstate->dcerpc.dcerpchdrudp.seqnum = (uint32_t) *(p++);
if (!(--input_len))
break;
/* fall through */
case 65:
sstate->dcerpc.dcerpchdrudp.seqnum |= *(p++) << 8;
sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p++) << 8;
if (!(--input_len))
break;
/* fall through */
case 66:
sstate->dcerpc.dcerpchdrudp.seqnum |= *(p++) << 16;
sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p++) << 16;
if (!(--input_len))
break;
/* fall through */
case 67:
sstate->dcerpc.dcerpchdrudp.seqnum |= *(p++) << 24;
sstate->dcerpc.dcerpchdrudp.seqnum |= (uint32_t) *(p++) << 24;
if (!(--input_len))
break;
/* fall through */

24
src/app-layer-dcerpc.c
Unescape Escape View File

@ -1295,19 +1295,19 @@ static int DCERPCParseHeader(DCERPC *dcerpc, uint8_t *input, uint32_t input_len)
dcerpc->dcerpchdr.frag_length |= *(p + 9) << 8;
dcerpc->dcerpchdr.auth_length = *(p + 10);
dcerpc->dcerpchdr.auth_length |= *(p + 11) << 8;
dcerpc->dcerpchdr.call_id = *(p + 12) << 24;
dcerpc->dcerpchdr.call_id |= *(p + 13) << 16;
dcerpc->dcerpchdr.call_id |= *(p + 14) << 8;
dcerpc->dcerpchdr.call_id |= *(p + 15);
dcerpc->dcerpchdr.call_id = (uint32_t) *(p + 12) << 24;
dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 13) << 16;
dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 14) << 8;
dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 15);
} else {
dcerpc->dcerpchdr.frag_length = *(p + 8) << 8;
dcerpc->dcerpchdr.frag_length |= *(p + 9);
dcerpc->dcerpchdr.auth_length = *(p + 10) << 8;
dcerpc->dcerpchdr.auth_length |= *(p + 11);
dcerpc->dcerpchdr.call_id = *(p + 12);
dcerpc->dcerpchdr.call_id |= *(p + 13) << 8;
dcerpc->dcerpchdr.call_id |= *(p + 14) << 16;
dcerpc->dcerpchdr.call_id |= *(p + 15) << 24;
dcerpc->dcerpchdr.call_id = (uint32_t) *(p + 12);
dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 13) << 8;
dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 14) << 16;
dcerpc->dcerpchdr.call_id |= (uint32_t) *(p + 15) << 24;
}
dcerpc->bytesprocessed = DCERPC_HDR_LEN;
SCReturnInt(16);
@ -1382,22 +1382,22 @@ static int DCERPCParseHeader(DCERPC *dcerpc, uint8_t *input, uint32_t input_len)
break;
/* fall through */
case 12:
dcerpc->dcerpchdr.call_id = *(p++);
dcerpc->dcerpchdr.call_id = (uint32_t) *(p++);
if (!(--input_len))
break;
/* fall through */
case 13:
dcerpc->dcerpchdr.call_id |= *(p++) << 8;
dcerpc->dcerpchdr.call_id |= (uint32_t) *(p++) << 8;
if (!(--input_len))
break;
/* fall through */
case 14:
dcerpc->dcerpchdr.call_id |= *(p++) << 16;
dcerpc->dcerpchdr.call_id |= (uint32_t) *(p++) << 16;
if (!(--input_len))
break;
/* fall through */
case 15:
dcerpc->dcerpchdr.call_id |= *(p++) << 24;
dcerpc->dcerpchdr.call_id |= (uint32_t) *(p++) << 24;
if (!(dcerpc->dcerpchdr.packed_drep[0] & 0x10)) {
dcerpc->dcerpchdr.frag_length = SCByteSwap16(dcerpc->dcerpchdr.frag_length);
dcerpc->dcerpchdr.auth_length = SCByteSwap16(dcerpc->dcerpchdr.auth_length);

Write Preview
Loading…
Cancel
Save