Merge pull request #1159 in SNORT/snort3 from ~BRASTULT/snort3:dce_rpc_fix to master

Squashed commit of the following:

commit 59acba7355b3c521339e3ad4fff99c3117d3ce23
Author: Brandon Stultz <brastult@cisco.com>
Date:   Mon Mar 26 18:29:32 2018 -0400

    dce_rpc: pass frag_ptr by reference

commit e3f33a7becfdf6da90f6bedc4371c8c597d34864
Author: Brandon Stultz <brastult@cisco.com>
Date:   Fri Mar 23 15:50:22 2018 -0400

    dce_rpc: fix parsing of dce/rpc ctx items

    dce_co_process_ctx_id needs to update its caller's (DCE2_CoCtxReq)
    frag_ptr as it is called in a loop in order to parse each dce/rpc
    ctx item, otherwise it ends up parsing the same ctx item over
    and over.

diff --git a/src/service_inspectors/dce_rpc/dce_co.cc b/src/service_inspectors/dce_rpc/dce_co.cc
index 7a7bf73435888e489504eaf74f7c3b9369f4ca2e..cc6a42920f6972ff071364c400d70f6dcba18994 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_co.cc
+++ b/src/service_inspectors/dce_rpc/dce_co.cc
@@ -521,7 +521,7 @@ static inline void DCE2_CoEraseCtxIds(DCE2_CoTracker* cot)
 
 static DCE2_CoCtxIdNode* dce_co_process_ctx_id(DCE2_SsnData* sd,DCE2_CoTracker* cot,
     const DceRpcCoHdr* co_hdr,DCE2_Policy policy,
-    const uint8_t* frag_ptr, uint16_t frag_len)
+    const uint8_t*& frag_ptr, uint16_t frag_len)
 {
     DCE2_CoCtxIdNode* ctx_node;
     DCE2_Ret status;