suricata
suricata copied to clipboard
smb/ntlmssp: improve version check
Don't assume the ntlmssp version field is always present if the flag is set. Instead keep track of the offsets of the data of the various blobs and see if there is space for the version.
Inspired by how Wireshark does the parsing.
Bug: #7121.
Private Pcap, so no public test.
Replaces #11368, fixing rust issues.