From 6909d0de877ff3a8e8b8cb94b5ac87f698e3725d Mon Sep 17 00:00:00 2001
From: Seth Hall <seth@icir.org>
Date: Thu, 5 Mar 2015 03:02:19 -0500
Subject: [PATCH] Fixes another optional part of an RDP unit.

---
 src/analyzer/protocol/rdp/rdp-protocol.pac | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/analyzer/protocol/rdp/rdp-protocol.pac b/src/analyzer/protocol/rdp/rdp-protocol.pac
index abb3fec004..32f59bd75f 100644
--- a/src/analyzer/protocol/rdp/rdp-protocol.pac
+++ b/src/analyzer/protocol/rdp/rdp-protocol.pac
@@ -106,8 +106,15 @@ type Connect_Confirm(cotp: COTP) = record {
 	destination_reference: uint16;
 	source_reference:      uint16;
 	flags:                 uint8;
+	switch1: case (offsetof(switch1) + 2 - cotp.cotp_len - 1) of {
+		0       -> none1:    empty;
+		default -> response: Connect_Confirm_Record;
+	};
+};
+
+type Connect_Confirm_Record = record {
 	response_type:         uint8;
-	response_switch: case response_type of {
+	switch1: case response_type of {
 		0x02 -> neg_resp: RDP_Negotiation_Response;
 		0x03 -> neg_fail: RDP_Negotiation_Failure;
 	};