From d241237c0fed4917246ccc2c65f8d8fa25bea88d Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Mon, 2 Mar 2026 09:14:24 +0530 Subject: [PATCH] Revert "dcerpc: fix consumed bytes post gap handling" This reverts commit fc9da1c7a1b30b6e1e0ae6d09b37768b27e4e4bc. That commit incorrectly used consumed as index of the slice passed to the Frame API. Found by oss-fuzz. --- rust/src/dcerpc/dcerpc.rs | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/rust/src/dcerpc/dcerpc.rs b/rust/src/dcerpc/dcerpc.rs index b13914a572..9d9b03b97b 100644 --- a/rust/src/dcerpc/dcerpc.rs +++ b/rust/src/dcerpc/dcerpc.rs @@ -766,7 +766,6 @@ impl DCERPCState { let retval; let mut cur_i = stream_slice.as_slice(); let mut consumed = 0u32; - let mut rem = cur_i.len() as u32; // Skip the record since this means that its in the middle of a known length record if (self.ts_gap && direction == Direction::ToServer) || (self.tc_gap && direction == Direction::ToClient) { @@ -799,7 +798,6 @@ impl DCERPCState { }, } } - rem -= consumed; let mut flow = std::ptr::null_mut(); if let Some(f) = self.flow { @@ -851,18 +849,17 @@ impl DCERPCState { cmp::Ordering::Greater => {} } - // rem == bytes consumed to move past gap; so those were not a part of the fragment - if rem < fraglen as u32 { + if cur_i.len() < fraglen as usize { SCLogDebug!("Possibly fragmented data, waiting for more.."); return AppLayerResult::incomplete(consumed, fraglen.into()); } let hdrtype = hdr.hdrtype; - let _hdr = Frame::new(flow, &stream_slice, &cur_i[consumed as usize..], DCERPC_HDR_LEN as i64, DCERPCFrameType::Hdr as u8, None); - let _pdu = Frame::new(flow, &stream_slice, &cur_i[consumed as usize..], fraglen as i64, DCERPCFrameType::Pdu as u8, None); - if fraglen >= DCERPC_HDR_LEN && rem > DCERPC_HDR_LEN as u32 { - let _data = Frame::new(flow, &stream_slice, &cur_i[(consumed + DCERPC_HDR_LEN as u32) as usize..], (fraglen - DCERPC_HDR_LEN) as i64, DCERPCFrameType::Data as u8, None); + let _hdr = Frame::new(flow, &stream_slice, cur_i, parsed as i64, DCERPCFrameType::Hdr as u8, None); + let _pdu = Frame::new(flow, &stream_slice, cur_i, fraglen as i64, DCERPCFrameType::Pdu as u8, None); + if fraglen >= DCERPC_HDR_LEN && cur_i.len() > DCERPC_HDR_LEN as usize { + let _data = Frame::new(flow, &stream_slice, &cur_i[DCERPC_HDR_LEN as usize..], (fraglen - DCERPC_HDR_LEN) as i64, DCERPCFrameType::Data as u8, None); } let current_call_id = hdr.call_id;