From 10109b6b9332df3542bf773607d79db491c0c684 Mon Sep 17 00:00:00 2001
From: Vlad Grigorescu <grigorescu@gmail.com>
Date: Wed, 29 May 2019 08:25:08 -0500
Subject: [PATCH] RDP: Add weird if specification violated for max channels
 allowed.

---
 scripts/base/protocols/rdp/main.zeek | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/base/protocols/rdp/main.zeek b/scripts/base/protocols/rdp/main.zeek
index 63b95b2835..5d95fa84fc 100644
--- a/scripts/base/protocols/rdp/main.zeek
+++ b/scripts/base/protocols/rdp/main.zeek
@@ -204,6 +204,10 @@ event rdp_client_network_data(c: connection, channels: ClientChannelList)
 		c$rdp$client_channels[i] = gsub(channels[i]$name, /\x00+$/, "");
 		}
 
+	if ( |channels| > 31 ) {
+		Reporter::conn_weird("RDP_channels_requested_exceeds_max", c, fmt("%s", |channels|));
+		}
+
 	}
 
 event rdp_gcc_server_create_response(c: connection, result: count) &priority=5