From: Philippe Antoine <pantoine@oisf.net>
Date: Fri, 17 Jun 2022 09:32:17 +0000 (+0200)
Subject: nfs4: fix write record handling
X-Git-Tag: suricata-7.0.0-beta1~245
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=95f042442304ba8498c6409968f24b7b3c53ffc2;p=thirdparty%2Fsuricata.git

nfs4: fix write record handling

Ticket: #5280
---

diff --git a/rust/src/nfs/nfs4.rs b/rust/src/nfs/nfs4.rs
index 95924df98a..d714ceadb8 100644
--- a/rust/src/nfs/nfs4.rs
+++ b/rust/src/nfs/nfs4.rs
@@ -52,6 +52,11 @@ impl NFSState {
             fill_bytes = 4 - pad;
         }
 
+        // linux defines a max of 1mb. Allow several multiples.
+        if w.write_len == 0 || w.write_len > 16777216 {
+            return;
+        }
+
         let file_handle = fh.to_vec();
         let file_name = if let Some(name) = self.namemap.get(fh) {
             SCLogDebug!("WRITE name {:?}", name);
@@ -115,8 +120,8 @@ impl NFSState {
             }
         }
         self.ts_chunk_xid = r.hdr.xid;
-        let file_data_len = w.data.len() as u32 - fill_bytes as u32;
-        self.ts_chunk_left = w.write_len as u32 - file_data_len as u32;
+        debug_validate_bug_on!(w.data.len() as u32 > w.write_len);
+        self.ts_chunk_left = w.write_len as u32 - w.data.len()  as u32;
     }
 
     fn close_v4<'b>(&mut self, r: &RpcPacket<'b>, fh: &'b [u8]) {