["Ronnie Sahlberg" <sahlberg@xxxxxxxxxxxxxxxx>]

Hi Todd, hi list

After reading up a bit on how dcerpc encodes pointers into the pdu's I came
up with
a crude dissect_ndr_pointer() function.

Note that this is an early attempt and does not even compile (since memory
allocations have not
been implemented yet).
I would though want comments as to if this approach would work and if it
would dissect deferred pointers
properly as per the dcerpc specification.

If Todd, or someone on the list which understands how pointers are encoded
in NDR, could just have a quick look
and tell me if it is a workable approach then I will finish the
implementation.

The interesting functions are
dissect_ndr_pointer()  which is to be called for any pointer for dcerpc
based dissectors. It takes as an argument a callback
function to dissect the data the pointer points to.

dissect_deferred_pointers() which is only used inside packet-dcerpc.c and
which is called after the subdissector has run to resolve
and dissect any deferred pointers not yet dissected.

This is somewhat redundant compared to what currently is in
packet-dcerpc-spoolss.c but I am not sure that implementation
can handle the full ndr semantics.

Attachment: dcerpc_pointers.diff
Description: Binary data