dcerpc: prevent integer underflow

[catenacyber]

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/7548

Describe changes:

• dcerpc: prevent integer underflow

There may be other things to do, like setting an event, but what remains to do is not clear to me.
What is clear to me is that this small change is an improvement.

First commit of #12528 with ticket

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 80.69%. Comparing base (d4330ef) to head (05fa4e5).
Report is 7 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #12532   +/-   ##
=======================================
  Coverage   80.68%   80.69%           
=======================================
  Files         925      925           
  Lines      258914   258914           
=======================================
+ Hits       208914   208920    +6     
+ Misses      50000    49994    -6     

Flag	Coverage Δ
fuzzcorpus	56.88% <100.00%> (+0.05%)	⬆️
livemode	19.41% <0.00%> (+<0.01%)	⬆️
pcap	44.19% <100.00%> (-0.01%)	⬇️
suricata-verify	63.39% <100.00%> (-0.01%)	⬇️
unittests	58.38% <100.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

Information: QA ran without warnings.

Pipeline 24627

[inashivb]

LGTM 🚀

[inashivb]

There may be other things to do, like setting an event, but what remains to do is not clear to me. What is clear to me is that this small change is an improvement.

@catenacyber could you please tell what is unclear to you?
We need to do https://redmine.openinfosecfoundation.org/issues/7254 and the related tickets that have been added by you.

[victorjulien]

Merged in #12553, thanks!

[catenacyber]

could you please tell what is unclear to you? We need to do https://redmine.openinfosecfoundation.org/issues/7254 and the related tickets that have been added by you.

How to implement events for DCERPC, and for this special case where I am not sure the data belongs to a transaction

[inashivb]

How to implement events for DCERPC, and for this special case where I am not sure the data belongs to a transaction

Indeed the transaction is created much later only if the data is complete. Maybe we should have something like protocol parser events to deal with such cases?

[catenacyber]

Maybe we should have something like protocol parser events to deal with such cases?

Maybe, that is what is unclear to me...