From 6149f151a6a832c4429572c0bc68cf6b5bf2edf8 Mon Sep 17 00:00:00 2001
From: Kirby Kuehl <kkuehl@gmail.com>
Date: Wed, 10 Mar 2010 13:57:24 -0600
Subject: [PATCH] add maximum andx chain depth

---
 src/app-layer-smb.c |   33 +++++++++++++++++++--------------
 src/app-layer-smb.h |    1 +
 2 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/src/app-layer-smb.c b/src/app-layer-smb.c
index 4b0a65b..182c898 100644
--- a/src/app-layer-smb.c
+++ b/src/app-layer-smb.c
@@ -716,6 +716,7 @@ static uint32_t NBSSParseHeader(Flow *f, void *smb_state,
             case 0:
                 /* Initialize */
                 sstate->andx.andxcommand = SMB_NO_SECONDARY_ANDX_COMMAND;
+                sstate->andx.maxchainedandx = 5;
                 if (input_len >= NBSS_HDR_LEN) {
                     sstate->nbss.type = *p;
                     sstate->nbss.length = (*(p + 1) & 0x01) << 16;
@@ -994,11 +995,11 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
                         sstate->bytesprocessed = 0;
                         SCReturnInt(-1);
                     }
-                }
-                SCLogDebug("[3] WordCount SMB Header (%u/%u) Command 0x%02x WordCount %u parsed %"PRIu64" input_len %u\n",
-				sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1,
-                        sstate->smb.command, sstate->wordcount.wordcount,
+                    SCLogDebug("[3] WordCount (%u/%u) WordCount %u parsed %"PRIu64" input_len %u\n",
+                		sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1,
+                        sstate->wordcount.wordcount,
                         parsed, input_len);
+                }
 
                 while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN
                             + SMB_HDR_LEN + 1 && sstate->bytesprocessed < NBSS_HDR_LEN
@@ -1013,11 +1014,11 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
                         sstate->bytesprocessed = 0;
                         SCReturnInt(-1);
                     }
-                }
-                SCLogDebug("[4] Parsing WordCount SMB Header (%u/%u) Command 0x%02x WordCount %u parsed %"PRIu64" input_len %u\n",
+                    SCLogDebug("[4] Parsing WordCount (%u/%u) WordCount %u parsed %"PRIu64" input_len %u\n",
 						sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount,
-                                        sstate->smb.command, sstate->wordcount.wordcount,
+                                        sstate->wordcount.wordcount,
                                         parsed, input_len);
+                }
 
                 while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN
                             + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount
@@ -1033,6 +1034,10 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
                         sstate->bytesprocessed = 0;
                         SCReturnInt(-1);
                     }
+                    SCLogDebug("[5] ByteCount (%u/%u) ByteCount %u parsed %"PRIu64" input_len %u\n",
+                                   		sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 3,
+                                           sstate->bytecount.bytecount,
+                                           parsed, input_len);
                 }
 
                 while (input_len && (sstate->bytesprocessed >= NBSS_HDR_LEN
@@ -1050,17 +1055,17 @@ static int SMBParse(Flow *f, void *smb_state, AppLayerParserState *pstate,
                         sstate->bytesprocessed = 0;
                         SCReturnInt(-1);
                     }
+                    SCLogDebug("[6] Parsing ByteCount (%u/%u) ByteCount %u parsed %"PRIu64" input_len %u\n",
+                   							sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount + 2 + sstate->bytecount.bytecount,
+                                                                          sstate->bytecount.bytecount, parsed, input_len);
                 }
-                SCLogDebug("[6] ByteCount SMB Header (%u/%u) Command 0x%02x WordCount %u ByteCount %u parsed %"PRIu64" input_len %u\n",
-							sstate->bytesprocessed, NBSS_HDR_LEN + SMB_HDR_LEN + 1 + sstate->wordcount.wordcount + 2 + sstate->bytecount.bytecount,
-                                                       sstate->smb.command, sstate->wordcount.wordcount,
-                                                       sstate->bytecount.bytecount, parsed, input_len);
 
             } while (sstate->andx.andxcommand != SMB_NO_SECONDARY_ANDX_COMMAND
-                    && input_len);
+                    && input_len && sstate->andx.maxchainedandx--);
 
-            if (sstate->bytesprocessed >= sstate->nbss.length + NBSS_HDR_LEN) {
-		sstate->bytesprocessed = 0;
+            if (sstate->bytesprocessed >= sstate->nbss.length + NBSS_HDR_LEN ||
+            		sstate->andx.maxchainedandx == 0) {
+            	sstate->bytesprocessed = 0;
             }
             break;
         default:
diff --git a/src/app-layer-smb.h b/src/app-layer-smb.h
index df624b9..8c2f555 100644
--- a/src/app-layer-smb.h
+++ b/src/app-layer-smb.h
@@ -50,6 +50,7 @@ typedef struct andxcount_ {
     uint8_t isandx;
     uint8_t paddingparsed;
     uint8_t andxcommand;
+    uint8_t maxchainedandx;
     uint16_t andxoffset;
     uint16_t andxbytesprocessed;
     uint16_t datalength;
-- 
1.6.6.1

