zeek/testing/btest/scripts/base
Jon Siwek c911d03c30 Adjust modbus register array parsing.
For modbus message types that include variable amount of register values
(uint16[]), setting a &length attribute without an explicit array size
could trigger a parsing assertion since it allows for the "element" data
pointer to travel past the "end of data" (e.g. when &length is odd).
This is changed to now give both an array size and &length to earlier
terminate the parsing of elements before the assert is checked and
so a single out-of-bound check can be done for the entire array
(leaving off &length causes an out-of-bound check for each element).

Added another parameter to modbus events that carry register arrays to
the script-layer which indicates the associated byte count from the
message (allowing for invalid values to be detected):

    modbus_read_holding_registers_response
    modbus_read_input_registers_response
    modbus_write_multiple_registers_request
    modbus_read_write_multiple_registers_request
    modbus_read_write_multiple_registers_response
    modbus_read_fifo_queue_response
2012-11-12 16:40:16 -06:00
..
frameworks Merge remote-tracking branch 'origin/topic/seth/intel-framework' 2012-11-01 08:21:52 -07:00
protocols Adjust modbus register array parsing. 2012-11-12 16:40:16 -06:00
utils Reorganizing btest/policy directory to match new scripts/ organization 2011-08-11 10:43:11 -05:00