From 333db3b3852899885f1c2a251b4643b124e3cb18 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Eloy=20P=C3=A9rez=20Gonz=C3=A1lez?= Date: Fri, 22 Oct 2021 15:01:39 +0200 Subject: [PATCH] smb/dce_opnum: move range if to outer context The smb dce_opnum matches all the opnums that are higher that the indicated opnum. This is due the range comparison if was put in the exact comparison context, and in case the opnum doesn't match exactly, then the range comparison is triggered (the upper limit is always true). Move the erroneus if to the outer context, as else option of the block checks if comparison should be exact or range. Ticket: 4767 --- rust/src/smb/detect.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rust/src/smb/detect.rs b/rust/src/smb/detect.rs index 6072e1131b..1c77d74608 100644 --- a/rust/src/smb/detect.rs +++ b/rust/src/smb/detect.rs @@ -111,9 +111,9 @@ pub extern "C" fn rs_smb_tx_match_dce_opnum(tx: &mut SMBTransaction, if range.range2 == DETECT_DCE_OPNUM_RANGE_UNINITIALIZED { if range.range1 == x.opnum as u32 { return 1; - } else if range.range1 <= x.opnum as u32 && range.range2 >= x.opnum as u32 { - return 1; } + } else if range.range1 <= x.opnum as u32 && range.range2 >= x.opnum as u32 { + return 1; } } }