From: Victor Julien <victor@inliniac.net>
Date: Tue, 13 Jun 2017 06:39:16 +0000 (+0200)
Subject: nfs3: fill bytes corner case
X-Git-Tag: suricata-4.0.0-rc1~49
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=25edac76661acc9a128a23271f763c425b3ff8f1;p=thirdparty%2Fsuricata.git

nfs3: fill bytes corner case
---

diff --git a/rust/src/nfs/nfs3.rs b/rust/src/nfs/nfs3.rs
index b0152f22b8..7dc18e2907 100644
--- a/rust/src/nfs/nfs3.rs
+++ b/rust/src/nfs/nfs3.rs
@@ -1071,6 +1071,7 @@ impl NFS3State {
         if pad != 0 {
             fill_bytes = 4 - pad;
         }
+        SCLogDebug!("XID {} fill_bytes {} reply.count {} reply.data_len {} reply.data.len() {}", r.hdr.xid, fill_bytes, reply.count, reply.data_len, reply.data.len());
 
         if nfs_version == 2 {
             let size = match parse_nfs2_attribs(reply.attr_blob) {
@@ -1132,7 +1133,7 @@ impl NFS3State {
         //}
         if !self.is_udp {
             self.tc_chunk_xid = r.hdr.xid;
-            self.tc_chunk_left = reply.count as u32 - reply.data.len() as u32;
+            self.tc_chunk_left = (reply.count as u32 + fill_bytes) - reply.data.len() as u32;
         }
 
         SCLogDebug!("REPLY {} to procedure {} blob size {} / {}: chunk_left {}",