From: Victor Julien <vjulien@oisf.net>
Date: Tue, 11 Jan 2022 07:09:56 +0000 (+0100)
Subject: nfs2: improve READ parsing
X-Git-Tag: suricata-7.0.0-beta1~1077
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F6764%2Fhead;p=thirdparty%2Fsuricata.git

nfs2: improve READ parsing

Take fill_bytes into account.
---

diff --git a/rust/src/nfs/nfs2_records.rs b/rust/src/nfs/nfs2_records.rs
index 991c0ba333..90516c42df 100644
--- a/rust/src/nfs/nfs2_records.rs
+++ b/rust/src/nfs/nfs2_records.rs
@@ -19,7 +19,7 @@
 
 use crate::nfs::nfs_records::*;
 use nom7::bytes::streaming::take;
-use nom7::combinator::rest;
+use nom7::combinator::{rest, cond};
 use nom7::number::streaming::be_u32;
 use nom7::IResult;
 
@@ -69,7 +69,9 @@ pub fn parse_nfs2_reply_read(i: &[u8]) -> IResult<&[u8], NfsReplyRead> {
     let (i, status) = be_u32(i)?;
     let (i, attr_blob) = take(68_usize)(i)?;
     let (i, data_len) = be_u32(i)?;
-    let (i, data_contents) = rest(i)?;
+    let (i, data_contents) = take(data_len)(i)?;
+    let fill_bytes = 4 - (data_len % 4);
+    let (i, _) = cond(fill_bytes != 0, take(fill_bytes))(i)?;
     let reply = NfsReplyRead {
         status,
         attr_follows: 1,