From: Victor Julien <victor@inliniac.net>
Date: Wed, 21 Mar 2018 14:52:44 +0000 (+0100)
Subject: nfs4: fix attr parsing corner case
X-Git-Tag: suricata-4.1.0-rc1~128
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=53fa2af07c12642b276c19da83d7c6aa070975ca;p=thirdparty%2Fsuricata.git

nfs4: fix attr parsing corner case
---

diff --git a/rust/src/nfs/nfs4_records.rs b/rust/src/nfs/nfs4_records.rs
index 0f77215e72..2db54cb619 100644
--- a/rust/src/nfs/nfs4_records.rs
+++ b/rust/src/nfs/nfs4_records.rs
@@ -63,7 +63,8 @@ named!(nfs4_parse_attrs<Nfs4Attr>,
     do_parse!(
         attr_cnt: be_u32
     >>  attr_mask1: be_u32
-    >>  attr_mask2: cond!(attr_cnt == 2, be_u32)
+    >>  attr_mask2: cond!(attr_cnt >= 2, be_u32)
+    >>  cond!(attr_cnt == 3, be_u32)
     >>  nfs4_parse_attr_fields
     >> ( Nfs4Attr {
             attr_mask: ((attr_mask1 as u64) << 32) | attr_mask2.unwrap_or(0) as u64,
@@ -74,7 +75,8 @@ named!(nfs4_parse_attrbits<Nfs4Attr>,
     do_parse!(
         attr_cnt: be_u32
     >>  attr_mask1: be_u32
-    >>  attr_mask2: cond!(attr_cnt == 2, be_u32)
+    >>  attr_mask2: cond!(attr_cnt >= 2, be_u32)
+    >>  cond!(attr_cnt == 3, be_u32)
     >> ( Nfs4Attr {
             attr_mask: ((attr_mask1 as u64) << 32) | attr_mask2.unwrap_or(0) as u64,
         } )