Merge pull request #2486 in SNORT/snort3 from ~VKAMBALA/snort3:vkambala to master

Squashed commit of the following:

commit 965d734d3a7b16cfa0bffd96e37f02a103942270
Author: krishnakanth <vkambala@cisco.com>
Date:   Thu Sep 17 05:50:32 2020 -0400

    dce_rpc: Handling Compound requests for upload

diff --git a/src/service_inspectors/dce_rpc/dce_smb2_commands.cc b/src/service_inspectors/dce_rpc/dce_smb2_commands.cc
index 11b6deb71fe66dfd12a98353892642ef2cbbeeab..63959731c1ded6796fd5de040195421c064bc598 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_smb2_commands.cc
+++ b/src/service_inspectors/dce_rpc/dce_smb2_commands.cc
@@ -755,7 +755,12 @@ static void DCE2_Smb2WriteRequest(DCE2_Smb2SsnData* ssd, const Smb2Hdr* smb_hdr,
 
     offset = alignedNtohq((const uint64_t*)(&(smb_write_hdr->offset)));
     DCE2_Smb2FileTracker* ftracker = ttr->findFtracker(fileId_persistent);
-    if (ftracker and !ftracker->ignore) // file tracker can not be nullptr here
+    if (!ftracker) // compounded create request + write request case
+    {
+        ftracker = new DCE2_Smb2FileTracker(fileId_persistent, ttr, str);
+        ttr->insertFtracker(fileId_persistent, ftracker);
+    }
+    if (!ftracker->ignore) // file tracker can not be nullptr here
     {
         if (ftracker->file_size and (offset > ftracker->file_size))
         {