From: Bhargava Jandhyala (bjandhya) <bjandhya@cisco.com>
Date: Tue, 22 Sep 2020 17:09:39 +0000 (+0000)
Subject: Merge pull request #2486 in SNORT/snort3 from ~VKAMBALA/snort3:vkambala to master
X-Git-Tag: 3.0.3-1~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d5bf7acf98f99b0c3f7c5ff52ff7615c071c6729;p=thirdparty%2Fsnort3.git

Merge pull request #2486 in SNORT/snort3 from ~VKAMBALA/snort3:vkambala to master

Squashed commit of the following:

commit 965d734d3a7b16cfa0bffd96e37f02a103942270
Author: krishnakanth <vkambala@cisco.com>
Date:   Thu Sep 17 05:50:32 2020 -0400

    dce_rpc: Handling Compound requests for upload
---

diff --git a/src/service_inspectors/dce_rpc/dce_smb2_commands.cc b/src/service_inspectors/dce_rpc/dce_smb2_commands.cc
index 11b6deb71..63959731c 100644
--- a/src/service_inspectors/dce_rpc/dce_smb2_commands.cc
+++ b/src/service_inspectors/dce_rpc/dce_smb2_commands.cc
@@ -755,7 +755,12 @@ static void DCE2_Smb2WriteRequest(DCE2_Smb2SsnData* ssd, const Smb2Hdr* smb_hdr,
 
     offset = alignedNtohq((const uint64_t*)(&(smb_write_hdr->offset)));
     DCE2_Smb2FileTracker* ftracker = ttr->findFtracker(fileId_persistent);
-    if (ftracker and !ftracker->ignore) // file tracker can not be nullptr here
+    if (!ftracker) // compounded create request + write request case
+    {
+        ftracker = new DCE2_Smb2FileTracker(fileId_persistent, ttr, str);
+        ttr->insertFtracker(fileId_persistent, ftracker);
+    }
+    if (!ftracker->ignore) // file tracker can not be nullptr here
     {
         if (ftracker->file_size and (offset > ftracker->file_size))
         {