Merge pull request #3699 from matrix/fix_26900_module_hash_encode

Fixed bug in 26900 module_hash_encode

docs/changes.txt

@@ -53,6 +53,7 @@
 - Fixed incorrect plaintext check for 25400 and 26610. Increased plaintext check to 32 bytes to prevent false positives.
 - Fixed bug in --stdout that caused certain rules to malfunction
 - Fixed bug in 18400 module_hash_encode
+- Fixed bug in 26900 module_hash_encode
 - Fixed bug in grep out-of-memory workaround on Unit Test
 - Fixed bug in input_tokenizer when TOKEN_ATTR_FIXED_LENGTH is used and refactor modules
 - Fixed build failed for 18400 with Apple Metal

src/modules/module_26900.c

@@ -284,7 +284,19 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
 
   out_len++;
 
-  out_len += hex_encode ((u8 *) snmpv3->engineID_buf, snmpv3->engineID_len, out_buf + out_len);
+  // remove zero padding from snmpv3->engineID_buf
+
+  u8 *engineID_buf_tmp = (u8 *) snmpv3->engineID_buf;
+
+  u32 engineID_len = snmpv3->engineID_len;
+
+  while (engineID_buf_tmp[engineID_len] == 0x00) engineID_len--;
+
+  engineID_len++;
+
+  // append to output
+
+  out_len += hex_encode ((u8 *) snmpv3->engineID_buf, engineID_len, out_buf + out_len);
 
   out_buf[out_len] = '$';