Commit graph

9 commits

Author SHA1 Message Date
Arne Welzel
c998cf697a netbios_decode: use unsigned char for result
The buf[i] < 3 condition in use previously allowed all chars (signed on x86)
through that had the 0x80 high-bit set after reconstructing from the two
bytes of the netbios name, resulting in escaped non-ascii content in
the logs.

Fixes more of #2742
2023-02-02 15:48:58 +01:00
Jon Siwek
76fb1e7fd0 Fixes to decode_netbios_name and decode_netbios_name_type BIFs
Fixes to `decode_netbios_name`:

* Improve validation that input string is a NetBIOS encoding
  (32 bytes, with characters ranging from 'A' to 'P').  This helps
  prevent Undefined Behavior of left-shifting negative values.
  Invalid encodings now cause a return-value of an empty string.

* More liberal in what decoded characters are allowed.  Namely,
  spaces are now allowed (but any trailing null-bytes and spaces
  are trimmed, similar to before).

Fixes to `decode_netbios_name_type`:

* Improve validation that input string is a NetBIOS encoding
  (32 bytes, with characters ranging from 'A' to 'P').  This helps
  prevent Undefined Behavior of left-shifting negative values and
  a heap-buffer-overread when the input string is too small.
  Invalid encodings now cause a return-value of 256.
2021-04-27 15:27:04 -07:00
Christian Kreibich
0b674eb851 Baseline refresh to reflect btest 0.64 2020-12-06 20:19:49 -08:00
Tim Wojtulewicz
21872aef39 Updating test baselines for new dictionary code due to changes in ordering of fields in the dictionary 2020-08-09 21:13:10 -07:00
Johanna Amann
cdb6a1b6e6 Baseline updates after hash function change. 2016-07-13 10:11:37 -07:00
Robin Sommer
7344052b50 Changing what's escaped when printing.
With this patch the model is:

    - "print" cleans the data so that non-printable characters get
      escaped. This is not necessarily reversible.

    - to print in a reversible way, one can go through
      escape_string(); this escapes backslashes as well to make the
      decoding non-ambigious.

    - Logging always escapes similar to escape_string(), making it
      reversible.

Compared to master, we also change the escaping as follows:

    - We now only escape with "\xXX", no more "^X" or "\0". Exception:
      backslashes.

    - We escape backlashes as "\\".

    - There's no "alternative" output style anymore, i.e., fmt() '%A'
      qualifier is gone.

Baselines in testing/btest are updated, external tests not yet.

Addresses BIT-1333.
2015-04-15 16:59:50 -07:00
Robin Sommer
5662fe7358 Updating baselines. 2011-04-23 10:47:14 -07:00
Robin Sommer
c80cd26e17 Merge remote branch 'origin/topic/seth/decode-nbns-names'
* origin/topic/seth/decode-nbns-names:
  Updates and tests for netbios name BiF.
2011-04-21 19:49:24 -07:00
Seth Hall
c564f545c0 Updates and tests for netbios name BiF.
* New BiF named: decode_netbios_name_type
* \x01 and \x02 are now decoded because I saw those
  bytes being actively used in names.
2011-04-20 15:59:11 -04:00