> Stack trace:
...
> (gdb) bt
> #0 0x402b2223 in strchr ()
> #1 0x81d049a in ?? ()
> #2 0x80a4dfd in dissect_transact_smb (pd=0x81d0420 "", offset=122, fd=0x889ab00, parent=0x0, tree=0x0, si={tid = 2053,
> uid = 4097, mid = 64, pid = 5376, conversation = 0x8232b90, request_val = 0x8233cb4}, max_data=118, SMB_offset=58,
> errcode=0, dirn=1) at packet-smb.c:9445
> #3 0x80a71f4 in dissect_smb (pd=0x81d0420 "", offset=90, fd=0x889ab00, tree=0x0, max_data=118) at packet-smb.c:11174
That's probably blowing up in "dissect_transact_params()", in the call
loc_of_slash = strchr(trans_type, '\\');
probably because 'trans_type" is NULL.
The code in "dissect_transact_params()" should probably be written as:
if (TransactNameCopy[0] == '\\') {
trans_type = TransactNameCopy + 1; /* Skip the slash */
loc_of_slash = strchr(trans_type, '\\');
if (loc_of_slash) {
index = loc_of_slash - trans_type; /* Make it a real index */
trans_cmd = trans_type + index + 1;
trans_type[index] = '\0';
}
else
trans_cmd = NULL;
} else
trans_cmd = NULL;
That will also require that the "strcmp()"s of "trans_type" against
"MAILSLOT" and "PIPE" be done only if "trans_type" is non-null, e.g.:
if (trans_type == NULL ||
((strcmp(trans_type, "MAILSLOT") != 0) ||
!dissect_mailslot_smb(...)) &&
((strcmp(trans_type, "PIPE") != 0) ||
!dissect_pipe_smb(...))) {
...
}
Richard, does that sound correct?
