smb: check on param parsing

Ticket: 5246

so as not to overflow u16

(cherry picked from commit 817a5001a50a90800547e66fef067c0443eb9f72)

diff --git a/rust/src/smb/smb1_records.rs b/rust/src/smb/smb1_records.rs
index 24d48a94853f34f0b44cb738d495a80216273caf..a27b9a9e43183c430af84273f734cfb5064ea12e 100644 (file)
--- a/rust/src/smb/smb1_records.rs
+++ b/rust/src/smb/smb1_records.rs
@@ -666,7 +666,7 @@ named!(pub parse_smb_trans2_request_record<SmbRequestTrans2Record>,
         >>  _timeout: le_u32
         >>  _reserved2: take!(2)
         >>  param_cnt: le_u16
-        >>  _param_offset: le_u16
+        >>  _param_offset: verify!(le_u16, |v| v <= (0xffffu16 - param_cnt))
         >>  data_cnt: le_u16
         >>  _data_offset: le_u16
         >>  _setup_cnt: le_u8