mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
b2a2ad7e10
A user provided a SMB2 pcap with the reserved1 field of a ReadResponse set to 1 instead of 0. This confused the padding computation due to including this byte into the offset. Properly split data_offset and reserved1 into individual byte fields. Closes #4730
9 lines
292 B
Text
9 lines
292 B
Text
# @TEST-DOC: Regression test for #4730, ReadResponse not parsed properly.
|
|
#
|
|
# @TEST-EXEC: zeek -b -C -r $TRACES/smb/smb_v2_only_non_zero_reserved1.pcap %INPUT
|
|
# @TEST-EXEC: btest-diff files.log
|
|
# @TEST-EXEC: test ! -f analyzer.log
|
|
# @TEST-EXEC: test ! -f weird.log
|
|
|
|
@load base/protocols/smb
|
|
|