Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 16:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/awelzel/4730-smb-read-response-data-offset'

Browse source 
* origin/topic/awelzel/4730-smb-read-response-data-offset:
  smb2/read: Parse only 1 byte for data_offset, ignore reserved1

(cherry picked from commit 76289a8022)
This commit is contained in:
Tim Wojtulewicz 2025-08-11 11:37:22 -07:00
parent 1511ca00df
commit fcdfe2aca2
7 changed files with 38 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
testing/btest/scripts/base/protocols/smb/smb2-read-response-non-zero-reserved1.test Normal file
View file

@ -0,0 +1,9 @@
# @TEST-DOC: Regression test for #4730, ReadResponse not parsed properly.
#
# @TEST-EXEC: zeek -b -C -r $TRACES/smb/smb_v2_only_non_zero_reserved1.pcap %INPUT
# @TEST-EXEC: btest-diff files.log
# @TEST-EXEC: test ! -f analyzer.log
# @TEST-EXEC: test ! -f weird.log
@load base/protocols/smb