From: Philippe Antoine <contact@catenacyber.fr>
Date: Sat, 2 Apr 2022 19:41:56 +0000 (+0200)
Subject: dcerpc: use wrappingadd for padding parsing
X-Git-Tag: suricata-7.0.0-beta1~675
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d2f00ac824068475414a6ee402c9ecf4b0de1308;p=thirdparty%2Fsuricata.git

dcerpc: use wrappingadd for padding parsing

As we compute a modulo, we can safely wrap around even if there
is an overflow

Ticket: #5301
---

diff --git a/rust/src/dcerpc/parser.rs b/rust/src/dcerpc/parser.rs
index 2ff4288692..befefe38c2 100644
--- a/rust/src/dcerpc/parser.rs
+++ b/rust/src/dcerpc/parser.rs
@@ -154,7 +154,7 @@ pub fn parse_dcerpc_bindack(i: &[u8]) -> IResult<&[u8], DCERPCBindAck> {
     let (i, _assoc_group) = take(4_usize)(i)?;
     let (i, sec_addr_len) = le_u16(i)?;
     let (i, _) = take(sec_addr_len)(i)?;
-    let (i, _) = cond((sec_addr_len + 2) % 4 != 0, |b| take(4 - (sec_addr_len + 2) % 4)(b))(i)?;
+    let (i, _) = cond((sec_addr_len.wrapping_add(2)) % 4 != 0, |b| take(4 - (sec_addr_len.wrapping_add(2)) % 4)(b))(i)?;
     let (i, numctxitems) = le_u8(i)?;
     let (i, _) = take(3_usize)(i)?; // Padding
     let (i, ctxitems) = count(parse_dcerpc_bindack_result, numctxitems as usize)(i)?;