[Guy Harris <gharris@xxxxxxxxx>]

> The patch also makes each pointer (to structure) be evaluated twice,
> once with conformant_run==1    and once with conformant_run==0.
> This is to make the dissection of non-fixed arrays work properly.
> Currently only unidimensional conformant and unidimensional conformant and
> varying arrays are implemented.
> This is however completely transparent to the dissector in say samr and only
> visible in packet-dcerpc.c
> However, it means that subdissectors can only call dissect_ndr_xxx
> functions, or other handcrafted functions which are aware
> of when to dissect scalars and when not to.
> See dissect_ndr_ucarray()m dissect_ndr_ucvarray() and
> dissect_deferred_pointers()  for examples on how this interaction
> works.

This causes the reply to a SAMR_QUERY_DISPINFO call not to be dissected
completely correctly.

DISPLAY_INFO is defined as

    typedef [switch_type(unsigned short)] union {
      [case(1)] USER_DISPINFO_1_ARRAY users1;
      [case(2)] USER_DISPINFO_2_ARRAY users2;
      [case(3)] GROUP_DISPINFO_ARRAY groups;
      [case(4)] ASCII_DISPINFO_ARRAY ausers;
      [case(5)] ASCII_DISPINFO_ARRAY agroups;
    } DISPLAY_INFO;

The dissector disects the "switch_type" value (as "Level"), and then
dissects the info.

For level 1, USER_DISPINFO_1_ARRAY is defined as

    typedef struct {
      long count;
      [size_is(count), ptr]  USER_DISPINFO_1 *users;
    } USER_DISPINFO_1_ARRAY;

It dissects the "count" field as "Max Count" (but it's *not* a count
field for a conformant array, it's just a number called "count"), and
then dissects the pointer.

Then it dissects the Referent ID.

It *should* then dissect the max_count for the array to which "users"
points, but it doesn't, because, in "dissect_deferred_pointers()":

	the first pass, with "conformant_run" true, passes null as the
	tree pointer, so nothing is put into the protocol tree when
	"dissect_ndr_ucarray()" calls "dissect_ndr_uint32()" to get the
	max_count;

	the second pass, with "conformant_run false, doesn't dissect the
	max_count header;

so there's no pass where the max_count header is dissected and the
"tree" argument is non-null.