Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/awelzel/4730-smb-read-response-data-offset'

Browse source 
* origin/topic/awelzel/4730-smb-read-response-data-offset:
  smb2/read: Parse only 1 byte for data_offset, ignore reserved1

(cherry picked from commit 76289a8022)
This commit is contained in:
Tim Wojtulewicz 2025-08-11 11:37:22 -07:00
parent 1511ca00df
commit fcdfe2aca2
7 changed files with 38 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/analyzer/protocol/smb/smb2-com-read.pac
View file

@ -93,10 +93,11 @@ type SMB2_read_request(header: SMB2_Header) = record {
type SMB2_read_response(header: SMB2_Header) = record {
structure_size : uint16;
data_offset : uint16;
data_offset : uint8;
reserved1 : uint8;
data_len : uint32;
data_remaining : uint32;
reserved : uint32;
reserved2 : uint32;
pad : padding to data_offset - header.head_length;
data : bytestring &length=data_len;
} &let {