From 3019f0c9de463c7a7c592cadc9437f7fdde80f1b Mon Sep 17 00:00:00 2001
From: nnposter <nnposter@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Wed, 20 May 2020 20:08:38 +0000
Subject: [PATCH] Fix DALC structure unmarshalling in TNS. Fixes #2010 The
 algorithm got broken in r37418 (4009f5fb172c5dd60ce0392c4cf2e514a2ed8aea),
 when string concatenation was replaced with table concatenation.

---
 CHANGELOG      |  3 +++
 nselib/tns.lua | 44 +++++++++++++++++---------------------------
 2 files changed, 20 insertions(+), 27 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 42ceb9830..780a89bd2 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -49,6 +49,9 @@ o [Windows] Add support for the new loopback behavior in Npcap 0.9983. This
   Adapter to be installed, which was a source of problems for some users.
   [Daniel Miller]
 
+o [NSE][GH#2010] Oracle TNS parser was incorrectly unmarshalling DALC byte
+  arrays [nnposter]
+
 o [NSE] Virtual host probing list, vhosts-full.lst, was missing numerous
   entries present in vhosts-default.lst [nnposter]
 
diff --git a/nselib/tns.lua b/nselib/tns.lua
index 37d484ca3..2d4e80f5f 100644
--- a/nselib/tns.lua
+++ b/nselib/tns.lua
@@ -1258,35 +1258,25 @@ Marshaller = {
   -- @param pos Position in the string at which the element begins
   -- @return table containing the last position read and the value parsed
   unmarshalKvpComponent = function( data, pos )
-    local value_len
-    local has_multiple_chunks = false
-    local value = {}
-
     -- read the 32-bit total length of the value
-    value_len, pos = string.unpack("<I4", data, pos )
-    if ( value_len ~= 0 ) then
-      -- Look at the first byte after the total length. If the value is
-      -- broken up into multiple chunks, this will be indicated by this
-      -- byte being 0xFE.
-      local first_byte = string.unpack("B", data, pos )
-      if ( first_byte == 0xFE ) then
-        has_multiple_chunks = true
-        pos = pos + 1 -- move pos past the multiple-chunks indicator
-      end
-
-      -- Loop through the chunks until we read the whole value
-      while ( value:len() < value_len ) do
-        local chunk
-        chunk, pos = string.unpack("s1", data, pos )
-        value[#value+1] = chunk
-      end
-
-      if ( has_multiple_chunks ) then
-        pos = pos + 1 -- there's a null byte after the last chunk
-      end
+    local value_len
+    value_len, pos = string.unpack("<I4", data, pos)
+    if value_len == 0 then return pos, "" end
+    -- Look at the first byte after the total length. If the value is
+    -- broken up into multiple chunks, this will be indicated by this
+    -- byte being 0xFE. Otherwise this is the length of the only chunk.
+    local chunked = string.unpack("B", data, pos) == 0xFE
+    if chunked then
+      pos = pos + 1
     end
-
-    return pos, table.concat(value)
+    -- Loop through the chunks until we read the whole value
+    local chunks = {}
+    repeat
+      local chunk
+      chunk, pos = string.unpack("s1", data, pos)
+      table.insert(chunks, chunk)
+    until #chunk == 0 or not chunked -- last chunk is zero-length
+    return pos, table.concat(chunks)
   end,
 }