smb1: Prevent accessing uninitialized referenced_tree

The added pcap was created from an OSS Fuzz test case and is borderline
valid SMB traffic, but it triggered a scripting error.

Closes #2726
This commit is contained in:
Arne Welzel 2023-01-27 19:22:09 +01:00
parent 589e042e26
commit 8be8c22b3e
5 changed files with 31 additions and 0 deletions

View file

@ -0,0 +1,10 @@
#@TEST-EXEC: zeek -b -C -r $TRACES/smb/smb1-OSS-fuzz-54883.pcap %INPUT
#@TEST-EXEC: btest-diff weird.log
#@TEST-EXEC: ! test -f reporter.log
@load base/protocols/smb
@load base/frameworks/notice/weird
# The traffic generated by OSS Fuzz is broken to the extreme, ensure
# the analyzer isn't disabled so the original scripting issue triggers.
redef DPD::ignore_violations += { Analyzer::ANALYZER_SMB };