From: Philippe Antoine <contact@catenacyber.fr>
Date: Mon, 4 Apr 2022 20:45:56 +0000 (+0200)
Subject: smb: check on param parsing
X-Git-Tag: suricata-5.0.9~33
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1202be4ca8dc463de869064dc3cc3818ff2757ca;p=thirdparty%2Fsuricata.git

smb: check on param parsing

Ticket: 5246

so as not to overflow u16

(cherry picked from commit 817a5001a50a90800547e66fef067c0443eb9f72)
---

diff --git a/rust/src/smb/smb1_records.rs b/rust/src/smb/smb1_records.rs
index 24d48a9485..a27b9a9e43 100644
--- a/rust/src/smb/smb1_records.rs
+++ b/rust/src/smb/smb1_records.rs
@@ -666,7 +666,7 @@ named!(pub parse_smb_trans2_request_record<SmbRequestTrans2Record>,
         >>  _timeout: le_u32
         >>  _reserved2: take!(2)
         >>  param_cnt: le_u16
-        >>  _param_offset: le_u16
+        >>  _param_offset: verify!(le_u16, |v| v <= (0xffffu16 - param_cnt))
         >>  data_cnt: le_u16
         >>  _data_offset: le_u16
         >>  _setup_cnt: le_u8