From 4e875c80d72596eee44f109155371552dcb8bf3e Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Wed, 21 Oct 2026 10:41:37 +0530 Subject: [PATCH] dcerpc: require PFC_LAST_FRAG for completion DCERPC REQUEST/RESPONSE records can have their stub data fragmented across multiple PDUs. The flags that convey the state of the current PDU are as follows: PFC_FIRST_FRAG: first fragment of (fragmented) data PFC_LAST_FRAG: last fragment of (fragmented) data PFC_FIRST_FRAG && PFC_LAST_FRAG: no fragmentation Consider a REQUEST/RESPONSE complete only when the PFC_LAST_FRAG flag is found to be set. Ticket: 9240 --- rust/src/dcerpc/dcerpc.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rust/src/dcerpc/dcerpc.rs b/rust/src/dcerpc/dcerpc.rs index 7ea109b69f..f5a7f2b816 100644 --- a/rust/src/dcerpc/dcerpc.rs +++ b/rust/src/dcerpc/dcerpc.rs @@ -1021,7 +1021,7 @@ fn evaluate_stub_params( if stub_len == 0 { return 0; } - if stub_len == lenleft && (fragtype == 0 || (fragtype & PFC_LAST_FRAG > 0)) { + if stub_len == lenleft && (fragtype & PFC_LAST_FRAG > 0) { *stub_data_buffer_reset = true; } @@ -1649,7 +1649,7 @@ mod tests { #[test] pub fn test_parse_dcerpc() { let request: &[u8] = &[ - 0x05, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, + 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe8, 0x03, 0x00, 0x00, 0x0b, 0x00, 0x09, 0x00, 0x45, 0x00, 0x2c, 0x00, 0x4d, 0x00, 0x73, 0x00, 0x53, 0x00, 0x59, 0x00, 0x2a, 0x00, 0x4a, 0x00, 0x7a, 0x00, 0x3e, 0x00, 0x58, 0x00, 0x21, 0x00, 0x4a, 0x00, 0x30, 0x00, 0x41, 0x00, 0x4b, 0x00,