dcerpc: set endian flag after applying transforms

dcerpc_tx_get_stub_data set the DCE byte-order flag before
SCInspectionBufferSetupAndApplyTransforms. Once a later commit makes
buffer setup reset the flags, that order would clear the flag and
break byte_test's dce option (dcerpc/dcerpc-dcepayload-15).

Set the flag after the call.

Issue: 7313
pull/16484/head
Jeff Lucovsky 4 months ago
parent 4badfd13f4
commit 2a572b0c50

@ -1,4 +1,4 @@
/* Copyright (C) 2020 Open Information Security Foundation
/* Copyright (C) 2020-2026 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
@ -426,15 +426,15 @@ unsafe extern "C" fn dcerpc_tx_get_stub_data(
tx.stub_data_buffer_tc.len() as u32,
)
};
SCInspectionBufferSetupAndApplyTransforms(
det_ctx, list_id, buffer, data, data_len, transforms,
);
if tx.endianness > 0 {
(*buffer).flags |= DETECT_CI_FLAGS_DCE_LE;
} else {
(*buffer).flags |= DETECT_CI_FLAGS_DCE_BE;
}
SCInspectionBufferSetupAndApplyTransforms(
det_ctx, list_id, buffer, data, data_len, transforms,
);
}
return buffer;
}

Loading…
Cancel
Save