[PATCH] dcerpc: use take instead of split_off(0)
authorPhilippe Antoine <pantoine@oisf.net>
Wed, 18 Feb 2026 14:00:08 +0000 (15:00 +0100)
committerAndreas Dolp <dev@andreas-dolp.de>
Thu, 23 Apr 2026 05:14:21 +0000 (07:14 +0200)
commit9e51ab4e76d811e86b09fc51d38ec8f171405449
tree69196f54f6fe086239cd46b1db7514e43a6b6c79
parentbaf1481f9c9fdcb664a7b230c138729738cc1214
[PATCH] dcerpc: use take instead of split_off(0)

Ticket: 8304

Avoids quadratic complexity.
With split_off(0), the whole vec is copied, so if wa have other
calls supplying one byte at a time, we keep on copying increasing
data

Origin: upstream, https://github.com/OISF/suricata/commit/281f419c0481f7d24d8ce5482b962673a3938e9b.patch
Bug: https://redmine.openinfosecfoundation.org/issues/8304
Subject: Upstream fix for CVE-2026-31937

Gbp-Pq: Name CVE-2026-31937.patch
rust/src/dcerpc/dcerpc.rs