mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
76fb1e7fd0
Fixes to `decode_netbios_name`: * Improve validation that input string is a NetBIOS encoding (32 bytes, with characters ranging from 'A' to 'P'). This helps prevent Undefined Behavior of left-shifting negative values. Invalid encodings now cause a return-value of an empty string. * More liberal in what decoded characters are allowed. Namely, spaces are now allowed (but any trailing null-bytes and spaces are trimmed, similar to before). Fixes to `decode_netbios_name_type`: * Improve validation that input string is a NetBIOS encoding (32 bytes, with characters ranging from 'A' to 'P'). This helps prevent Undefined Behavior of left-shifting negative values and a heap-buffer-overread when the input string is too small. Invalid encodings now cause a return-value of 256.
27 lines
941 B
Text
27 lines
941 B
Text
#
|
|
# @TEST-EXEC: zeek -b %INPUT >out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
function decode_name(name: string)
|
|
{
|
|
local dn = decode_netbios_name(name);
|
|
local suffix = decode_netbios_name_type(name);
|
|
print suffix, |dn|, dn;
|
|
}
|
|
|
|
local encoded_names = vector(
|
|
"ejfdebfeebfacacacacacacacacacaaa", # ISATAP
|
|
"fhepfcelehfcepfffacacacacacacabl", # WORKGROUP
|
|
"abacfpfpenfdecfcepfhfdeffpfpacab", # \001\002__MSBROWSE__\002
|
|
"enebfcfeejeocacacacacacacacacaad", # MARTIN
|
|
"FEEIEFCAEOEFFEECEJEPFDCAEOEBENEF", # THE NETBIOS NAM
|
|
"cbcccdcecfcgchcicjckclcmcncodnaa", # !"#$%&'()*+,-.=
|
|
"dkdleafofphlhnhoaaaaaaaaaaaaaaaa", # :;@^_{}~
|
|
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", # empty
|
|
"cacacacacacacacacacacacacacacaca", # empty
|
|
"abcd", # invalid length
|
|
"~jfdebfeebfacacacacacacacacacaaa", # invalid alphabet
|
|
"0jfdebfeebfacacacacacacacacacaaa");# invalid alphabet
|
|
|
|
for ( i in encoded_names )
|
|
decode_name(encoded_names[i]);
|