From 7819453af59ab85b24ecd939cbd710f3c206d11f Mon Sep 17 00:00:00 2001
From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Thu, 20 Sep 2018 02:19:53 +0000
Subject: [PATCH] Fix some incorrect conversions from bin to string unpacking

---
 nselib/giop.lua               | 2 +-
 nselib/msrpctypes.lua         | 2 +-
 nselib/ncp.lua                | 4 ++--
 nselib/smb2.lua               | 2 +-
 scripts/telnet-encryption.nse | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/nselib/giop.lua b/nselib/giop.lua
index 36295774d..877f69154 100644
--- a/nselib/giop.lua
+++ b/nselib/giop.lua
@@ -405,7 +405,7 @@ Packet.GIOP.list =
     local UNKNOWN, UNKNOWN2, UNKNOWN3 = 2, 1, 6
 
     local data = {
-      string.pack(">I4BxxxI2I2s4s4xxCI", self.id, self.flags,
+      string.pack(">I4BxxxI2I2s4s4xxBI4", self.id, self.flags,
         self.target_addr, UNKNOWN, self.key_addr,
         self.op, UNKNOWN2, #self.sc )
     }
diff --git a/nselib/msrpctypes.lua b/nselib/msrpctypes.lua
index f688b730a..462feacaf 100644
--- a/nselib/msrpctypes.lua
+++ b/nselib/msrpctypes.lua
@@ -847,7 +847,7 @@ function unmarshall_int32(data, pos)
     stdnse.debug1("MSRPC: ERROR: Ran off the end of a packet in unmarshall_int32(). Please report!")
     return pos, nil
   end
-  pos, value = string.unpack("<I4", data, pos)
+  value, pos = string.unpack("<I4", data, pos)
 
   return pos, value
 end
diff --git a/nselib/ncp.lua b/nselib/ncp.lua
index d746eb4f5..2c03e7433 100644
--- a/nselib/ncp.lua
+++ b/nselib/ncp.lua
@@ -909,11 +909,11 @@ NCP = {
     -- a bunch of unknowns
     local u2, u3, u4, u5, u6, u7, u8, u9 = 0, 0, 2, 2, 0, 0x10, 0, 0x11
 
-    local data = string.pack("<I4I4I4 I2I2I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 AI4 I4 I4 A",
+    local data = string.pack("<I4I4I4 I2I2I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 I4 s4 I4 I4 s4",
       frag_handle, frag_size, msg_size, unknown, proto_flags,
       nds_verb, nds_reply_buf, version, flags, iter_handle,
       base.id, repl_type, numobjs, info_types, info_flags, u2, u3, u4,
-      u5, u6, u7, #w_name, w_name, u8, u9, #w_class, w_class )
+      u5, u6, u7, w_name, u8, u9, w_class )
     p:setData(data)
     return self:Exch( p )
   end,
diff --git a/nselib/smb2.lua b/nselib/smb2.lua
index 259545ad7..369d676a2 100644
--- a/nselib/smb2.lua
+++ b/nselib/smb2.lua
@@ -127,7 +127,7 @@ function smb2_send(smb, header, data, overrides)
   local attempts           = 5
   local status, err
 
-  local out = string.pack(">I<c" .. #body, #body, body)
+  local out = string.pack(">s4", body)
   repeat
     attempts = attempts - 1
     stdnse.debug3("SMB: Sending SMB packet (len: %d, attempts remaining: %d)", #out, attempts)
diff --git a/scripts/telnet-encryption.nse b/scripts/telnet-encryption.nse
index 1de91c320..1f2f6f895 100644
--- a/scripts/telnet-encryption.nse
+++ b/scripts/telnet-encryption.nse
@@ -63,7 +63,7 @@ local function processOptions(data)
         return false, "Failed to parse options"
       end
     else
-      pos, option = string.unpack("B", data, pos)
+      option, pos = string.unpack("B", data, pos)
       result[option] = result[option] or {}
       table.insert(result[option], cmd)
     end