a small patch to binpac

Zeek
1

The problem:

     type MyRecord = record {
         f1: SomeRecordType;
         f2: bytestring &length=body_len;
     } &let {
         body_len: uint32 = f1.rec_len - sizeof (f1);
     };

The above definition looks familiar, uh? It is a simplifed version of
the DCE RPC PDU. If MyRecord is incrementally parsed, the sizeof (f1) in the &let construct will cause trouble because getFieldBegin and
getFieldEnd can only be used for non-incremental parsed record. If
the size of SomeRecordType is decideable statically (in the case of
DCE RPC, it is), then the patch fixes the problem. Now we can make the PDU incrementally parsed.

Cheers,

Jimmy

fieldsize.patch (534 Bytes)

2

Thanks! I will integrate this patch.

Ruoming