mirror of
https://github.com/zeek/zeek.git
synced 2025-10-11 19:18:19 +00:00
Adjust modbus register array parsing.
For modbus message types that include variable amount of register values (uint16[]), setting a &length attribute without an explicit array size could trigger a parsing assertion since it allows for the "element" data pointer to travel past the "end of data" (e.g. when &length is odd). This is changed to now give both an array size and &length to earlier terminate the parsing of elements before the assert is checked and so a single out-of-bound check can be done for the entire array (leaving off &length causes an out-of-bound check for each element). Added another parameter to modbus events that carry register arrays to the script-layer which indicates the associated byte count from the message (allowing for invalid values to be detected): modbus_read_holding_registers_response modbus_read_input_registers_response modbus_write_multiple_registers_request modbus_read_write_multiple_registers_request modbus_read_write_multiple_registers_response modbus_read_fifo_queue_response
This commit is contained in:
parent
defed7b6f3
commit
c911d03c30
9 changed files with 79 additions and 22 deletions
|
@ -0,0 +1,12 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path modbus
|
||||
#open 2012-11-12-21-51-15
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p func exception
|
||||
#types time string addr port addr port string string
|
||||
1342774775.305761 UWkUyAuUGXf 10.1.1.234 51411 10.10.5.104 502 READ_INPUT_REGISTERS -
|
||||
1342775209.493066 arKYeMETxOg 10.1.1.234 51411 10.10.5.104 502 READ_INPUT_REGISTERS -
|
||||
1342776371.617757 nQcgTWjvg4c 10.1.1.234 51411 10.10.5.104 502 READ_INPUT_REGISTERS -
|
||||
#close 2012-11-12-21-51-15
|
Loading…
Add table
Add a link
Reference in a new issue