Merge remote-tracking branch 'origin/topic/awelzel/2726-smb1-expr-error-with-tree-connect-response'

* origin/topic/awelzel/2726-smb1-expr-error-with-tree-connect-response:
  smb1: Prevent accessing uninitialized referenced_tree

CHANGES

@@ -1,3 +1,12 @@
+5.2.0-dev.557 | 2023-01-27 13:24:58 -0700
+
+  * smb1: Prevent accessing uninitialized referenced_tree (Arne Welzel, Corelight)
+
+    The added pcap was created from an OSS Fuzz test case and is borderline
+    valid SMB traffic, but it triggered a scripting error.
+
+    Closes #2726
+
 5.2.0-dev.553 | 2023-01-27 13:23:09 -0700
 
   * Add tooling section to README (Tim Wojtulewicz, Corelight)

VERSION

@@ -1 +1 @@
-5.2.0-dev.555
+5.2.0-dev.557

scripts/base/frameworks/notice/weird.zeek

@@ -206,6 +206,7 @@ export {
 		["SMB_parsing_error"]                   = ACTION_LOG,
 		["no_smb_session_using_parsesambamsg"]  = ACTION_LOG,
 		["smb_andx_command_failed_to_parse"]    = ACTION_LOG,
+		["smb_tree_connect_andx_response_without_tree"] = ACTION_LOG_PER_CONN,
 		["transaction_subcmd_missing"]          = ACTION_LOG,
 		["successful_RPC_reply_to_invalid_request"] = ACTION_NOTICE_PER_ORIG,
 		["SYN_after_close"]                     = ACTION_LOG,

scripts/base/protocols/smb/smb1-main.zeek

@@ -107,6 +107,15 @@ event smb1_tree_connect_andx_request(c: connection, hdr: SMB1::Header, path: str
 
 event smb1_tree_connect_andx_response(c: connection, hdr: SMB1::Header, service: string, native_file_system: string) &priority=5
 	{
+	# If the current_cmd does not have a referenced tree, then likely we
+	# missed the  SMB_COM_TREE_CONNECT_ANDX. Report a weird and stop.
+	if ( ! c$smb_state$current_cmd?$referenced_tree )
+		{
+		local addl = fmt("current_cmd=%s", c$smb_state$current_cmd$command);
+		Reporter::conn_weird("smb_tree_connect_andx_response_without_tree", c, addl);
+		return;
+		}
+
 	c$smb_state$current_cmd$referenced_tree$service = service;
 	if ( service == "IPC" )
 		c$smb_state$current_cmd$referenced_tree$share_type = "PIPE";

testing/btest/Baseline/scripts.base.protocols.smb.smb1-OSS-fuzz-54883/weird.log

@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	weird
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	name	addl	notice	peer	source
+#types	time	string	addr	port	addr	port	string	string	bool	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	10.0.0.1	38511	10.0.0.2	139	smb_tree_connect_andx_response_without_tree	current_cmd=WRITE_ANDX	F	zeek	-
+#close XXXX-XX-XX-XX-XX-XX

testing/btest/scripts/base/protocols/smb/smb1-OSS-fuzz-54883.test

@@ -0,0 +1,10 @@
+#@TEST-EXEC: zeek -b -C -r $TRACES/smb/smb1-OSS-fuzz-54883.pcap %INPUT
+#@TEST-EXEC: btest-diff weird.log
+#@TEST-EXEC: ! test -f reporter.log
+
+@load base/protocols/smb
+@load base/frameworks/notice/weird
+
+# The traffic generated by OSS Fuzz is broken to the extreme, ensure
+# the analyzer isn't disabled so the original scripting issue triggers.
+redef DPD::ignore_violations += { Analyzer::ANALYZER_SMB };