dcerpc: fix consumed bytes post gap handling

The parser could receive an input that consists of arbitrary data post
gap. This is handled in the beginning of the fn handle_input_data.
However, the rest of the calculation does not take into account the
bytes that were consumed at this stage. Fix the indices and calculations
to consider a new DCERPC fragment beginning post these consumed bytes.

rust/src/dcerpc/dcerpc.rs

@@ -765,6 +765,7 @@ impl DCERPCState {
         let retval;
         let mut cur_i = stream_slice.as_slice();
         let mut consumed = 0u32;
+        let mut rem = cur_i.len() as u32;
 
         // Skip the record since this means that its in the middle of a known length record
         if (self.ts_gap && direction == Direction::ToServer) || (self.tc_gap && direction == Direction::ToClient) {
@@ -797,6 +798,7 @@ impl DCERPCState {
                 },
             }
         }
+        rem -= consumed;
 
         let mut flow = std::ptr::null_mut();
         if let Some(f) = self.flow {
@@ -836,17 +838,18 @@ impl DCERPCState {
         let parsed = DCERPC_HDR_LEN;
         let fraglen = hdr.frag_length;
 
-        if cur_i.len() < fraglen as usize {
+        // rem == bytes consumed to move past gap; so those were not a part of the fragment
+        if rem < fraglen as u32 {
             SCLogDebug!("Possibly fragmented data, waiting for more..");
             return AppLayerResult::incomplete(consumed, fraglen.into());
         }
 
         let hdrtype = hdr.hdrtype;
 
-        let _hdr = Frame::new(flow, &stream_slice, cur_i, parsed as i64, DCERPCFrameType::Hdr as u8, None);
-        let _pdu = Frame::new(flow, &stream_slice, cur_i, fraglen as i64, DCERPCFrameType::Pdu as u8, None);
-        if fraglen >= DCERPC_HDR_LEN && cur_i.len() > DCERPC_HDR_LEN as usize {
-            let _data = Frame::new(flow, &stream_slice, &cur_i[DCERPC_HDR_LEN as usize..], (fraglen - DCERPC_HDR_LEN) as i64, DCERPCFrameType::Data as u8, None);
+        let _hdr = Frame::new(flow, &stream_slice, &cur_i[consumed as usize..], DCERPC_HDR_LEN as i64, DCERPCFrameType::Hdr as u8, None);
+        let _pdu = Frame::new(flow, &stream_slice, &cur_i[consumed as usize..], fraglen as i64, DCERPCFrameType::Pdu as u8, None);
+        if fraglen >= DCERPC_HDR_LEN && rem > DCERPC_HDR_LEN as u32 {
+            let _data = Frame::new(flow, &stream_slice, &cur_i[(consumed + DCERPC_HDR_LEN as u32) as usize..], (fraglen - DCERPC_HDR_LEN) as i64, DCERPCFrameType::Data as u8, None);
         }
         let current_call_id = hdr.call_id;