mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 18:18:19 +00:00
Add test case for binpac flowbuffer frame length parsing bug
This commit is contained in:
parent
e2aeb70efc
commit
7e57f0788c
13 changed files with 265 additions and 1 deletions
40
testing/btest/plugins/binpac-flowbuffer-frame-length.zeek
Normal file
40
testing/btest/plugins/binpac-flowbuffer-frame-length.zeek
Normal file
|
@ -0,0 +1,40 @@
|
|||
# This test exercises a previous bug in binpac flowbuffer frame length
|
||||
# boundary checks:
|
||||
|
||||
# Incremental flowbuffer parsing sought to first parse the "minimum header
|
||||
# length" required to get the full frame length, possibly from a record
|
||||
# field, but generating the logic to parse that field could greedily
|
||||
# bundle in additional boundary-checks for all subsequent fields of
|
||||
# known-size.
|
||||
#
|
||||
# E.g. for flowunit parsing of this:
|
||||
#
|
||||
# type HDR = record {
|
||||
# version: uint8;
|
||||
# reserved: uint8;
|
||||
# len: uint16;
|
||||
# } &byteorder=bigendian;
|
||||
#
|
||||
# type FOO_PDU(is_orig: bool) = record {
|
||||
# hdr: HDR;
|
||||
# plen: uint8;
|
||||
# ptype: uint8;
|
||||
# something: bytestring &restofdata;
|
||||
# } &byteorder=bigendian, &length=hdr.len;
|
||||
|
||||
# The flowbuffer was correctly seeking to buffer 4 bytes and parse the
|
||||
# "hdr.len" field, but the generated parsing logic for "hdr.len" included
|
||||
# a boundary check all the way up to include "plen" and "ptype".
|
||||
|
||||
# This causes out-of-bounds exceptions to be thrown for inputs that should
|
||||
# actually be possible to incrementally parse via flowbuffer.
|
||||
|
||||
# @TEST-EXEC: ${DIST}/aux/zeek-aux/plugin-support/init-plugin -u . Foo FOO
|
||||
# @TEST-EXEC: cp -r %DIR/binpac-flowbuffer-frame-length-plugin/* .
|
||||
# @TEST-EXEC: ./configure --zeek-dist=${DIST} && make
|
||||
# @TEST-EXEC: ZEEK_PLUGIN_PATH=`pwd` zeek -r $TRACES/mmsX.pcap %INPUT >output
|
||||
|
||||
event Foo::foo_message(c: connection, is_orig: bool, len: count, plen: count, ptype: count)
|
||||
{
|
||||
print "foo_message", len, plen, ptype;
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue