From 88d3af4c2ee85d903782e04fe64b9ac07c85a29f Mon Sep 17 00:00:00 2001
From: Shivani Bhardwaj <shivani@oisf.net>
Date: Wed, 19 Aug 2026 11:03:04 +0530
Subject: [PATCH] enip: make sure to have enough data for parser

ENIP parser makes use of nom's complete macros which by design expect
full data to be passed along to them. In case there is incomplete data
sent to them, they result in an error. This disables the ENIP parser and
further detection and could happen with an incomplete/fragmented
request/response.

Use AppLayerResult API to ask for more data from the stream engine in
case the stream slice currently at hand does not match the length
parameters received from the header or is not long enough to parse the
header itself.

Ticket: 8809
---
 rust/src/enip/enip.rs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/rust/src/enip/enip.rs b/rust/src/enip/enip.rs
index 5e69c1dd71..1bc0a32d56 100644
--- a/rust/src/enip/enip.rs
+++ b/rust/src/enip/enip.rs
@@ -291,6 +291,15 @@ impl EnipState {
         }
         let mut start = input;
         while !start.is_empty() {
+            if start.len() < ENIP_HEADER_LEN as usize {
+                let consumed = (input.len() - start.len()) as u32;
+                return AppLayerResult::incomplete(consumed, ENIP_HEADER_LEN);
+            }
+            let pdulen = u16::from_le_bytes([start[2], start[3]]) as u32;
+            if (start.len() as u32) < ENIP_HEADER_LEN + pdulen {
+                let consumed = (input.len() - start.len()) as u32;
+                return AppLayerResult::incomplete(consumed, ENIP_HEADER_LEN + pdulen);
+            }
             match parser::parse_enip_pdu(start) {
                 Ok((rem, pdu)) => {
                     if !request {