mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
69d541593e
The claim is read as a word followed by one nfsstring whatever its type, so only CLAIM_NULL and CLAIM_DELEGATE_PREV land on the next op. CLAIM_FH and CLAIM_DELEG_PREV_FH carry nothing: their OPEN takes the following op's tag as a name length. CLAIM_PREVIOUS carries an open_delegation_type4, CLAIM_DELEG_CUR_FH a stateid and CLAIM_DELEGATE_CUR a stateid then a name: all of them leave the parse in the middle of the record, so every later op of the compound misparses and the filename is whatever the read landed on. The open owner's XDR pad and the fattr4 that follows an EXCLUSIVE4_1 verifier go missing the same way, and an EXCLUSIVE4_1 OPEN loses its name to the attributes it never consumed. Read the union by its type: a name for 0, 2 and 3, a word for 1, a stateid for 2 and 5, nothing for 4 and 6, and an error for a type no version defines. The filename stays empty where the claim carries none, as the file is named by the current filehandle. The compound scanner can then follow the parser through all seven claims instead of rejecting the record, so a WRITE behind a filehandle-based OPEN is still reached, and an unknown claim stays a bounded reject. Ticket: #9265. |
1 day ago | |
|---|---|---|
| .. | ||
| .cargo | 2 years ago | |
| derive | 5 days ago | |
| ffi | 1 day ago | |
| htp | 5 days ago | |
| src | 1 day ago | |
| suricatactl | 5 days ago | |
| suricatasc | 5 days ago | |
| sys | 5 days ago | |
| .gitignore | 2 years ago | |
| Cargo.lock.in | 5 days ago | |
| Cargo.toml.in | 5 days ago | |
| Makefile.am | 5 days ago | |
| cbindgen.toml | 4 months ago | |
| rustfmt.toml | 3 years ago | |