Wireshark-dev: Re: [Wireshark-dev] Parsing array and its size in EcDoRpcExt2
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Harsha <inet.harsha@xxxxxxxxx>
Date: Mon, 27 Apr 2009 17:32:06 -0700
On Mon, Apr 27, 2009 at 3:38 PM, Harsha <inet.harsha@xxxxxxxxx> wrote:
> I did a quick read of the relevant part of DCE RPC specs, but in all
> the cases I saw it always had the size and then the array. In those
> cases it is trivial to first extract the size and use the size to
> extract the array contents.
Here is an example in Wireshark code where the length of the array and
then the array are extracted-
void ept_lookup(
[in] handle_t hEpMapper,
[in] unsigned long inquiry_type,
[in, ptr] UUID* object,
[in, ptr] RPC_IF_ID* Ifid,
[in] unsigned long vers_option,
[in, out] ept_lookup_handle_t* entry_handle,
[in, range(0,500)] unsigned long max_ents,
[out] unsigned long* num_ents,
[out, length_is(*num_ents), size_is(max_ents)] ept_entry_t entries[], <-----
[out] error_status* status );

Related dissecting code that extracts the length of the array and then
array is in epm_dissect_ept_map_resp() in packet-dcerpc-epm.c.

Unfortunately I don't see any other case where the array comes ahead
of its length.

Thanks,
Harsha