dcerpc: require PFC_LAST_FRAG for completion

DCERPC REQUEST/RESPONSE records can have their stub data fragmented
across multiple PDUs. The flags that convey the state of the current PDU
are as follows:

PFC_FIRST_FRAG: first fragment of (fragmented) data
PFC_LAST_FRAG: last fragment of (fragmented) data
PFC_FIRST_FRAG && PFC_LAST_FRAG: no fragmentation

Consider a REQUEST/RESPONSE complete only when the PFC_LAST_FRAG flag is
found to be set.

Ticket: 9240
pull/16497/head
Shivani Bhardwaj 6 days ago committed by Victor Julien
parent 912c545075
commit 4e875c80d7

@ -1021,7 +1021,7 @@ fn evaluate_stub_params(
if stub_len == 0 {
return 0;
}
if stub_len == lenleft && (fragtype == 0 || (fragtype & PFC_LAST_FRAG > 0)) {
if stub_len == lenleft && (fragtype & PFC_LAST_FRAG > 0) {
*stub_data_buffer_reset = true;
}
@ -1649,7 +1649,7 @@ mod tests {
#[test]
pub fn test_parse_dcerpc() {
let request: &[u8] = &[
0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00,
0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0xe8, 0x03, 0x00, 0x00, 0x0b, 0x00, 0x09, 0x00, 0x45, 0x00, 0x2c, 0x00,
0x4d, 0x00, 0x73, 0x00, 0x53, 0x00, 0x59, 0x00, 0x2a, 0x00, 0x4a, 0x00, 0x7a, 0x00,
0x3e, 0x00, 0x58, 0x00, 0x21, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x41, 0x00, 0x4b, 0x00,

Loading…
Cancel
Save