You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/rust/src/rdp
Giuseppe Longo 8c9bca92fb rdp: treat tpkt payload as complete input
parse_t123_tpkt runs the X.224 and X.223/MCS sub-parsers over the
length-bounded tpkt payload, but they use streaming nom parsers.
An inner length field overrunning the payload, such as an oversized
CS_CORE block, escaped as Err::Incomplete although the tpkt was fully
present.

This patch wraps the child parsers in complete() so Incomplete from within the
bounded payload becomes an Error.
The tpkt is then returned as an unrecognized Raw child, which the caller skips,
and parsing resumes at the next tpkt.

Ticket #8838
2 months ago
..
error.rs rust/rdp: convert to nom 8 1 year ago
log.rs rust/rdp: namespace and visibility cleanups 2 years ago
mod.rs rust/doc: add docstring to rust module files. 3 years ago
parser.rs rdp: treat tpkt payload as complete input 2 months ago
rdp.rs rdp: treat tpkt payload as complete input 2 months ago
util.rs rust/rdp: convert to nom 8 1 year ago
windows.rs rust/clippy: fix lint: needless_lifetimes 4 years ago