mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 23:58:20 +00:00
c911d03c30
For modbus message types that include variable amount of register values
(uint16[]), setting a &length attribute without an explicit array size
could trigger a parsing assertion since it allows for the "element" data
pointer to travel past the "end of data" (e.g. when &length is odd).
This is changed to now give both an array size and &length to earlier
terminate the parsing of elements before the assert is checked and
so a single out-of-bound check can be done for the entire array
(leaving off &length causes an out-of-bound check for each element).
Added another parameter to modbus events that carry register arrays to
the script-layer which indicates the associated byte count from the
message (allowing for invalid values to be detected):
modbus_read_holding_registers_response
modbus_read_input_registers_response
modbus_write_multiple_registers_request
modbus_read_write_multiple_registers_request
modbus_read_write_multiple_registers_response
modbus_read_fifo_queue_response
20 lines
1,017 B
Text
20 lines
1,017 B
Text
# @TEST-EXEC: bro -r $TRACES/modbus/fuzz-1011.trace %INPUT >output
|
|
# @TEST-EXEC: btest-diff modbus.log
|
|
# @TEST-EXEC: btest-diff output
|
|
|
|
# modbus registers are 2-byte values. Many messages send a variable amount
|
|
# of register values, with the quantity being derived from a byte count value
|
|
# that is also sent. If the byte count value is invalid (e.g. an odd value
|
|
# might not be valid since registers must be 2-byte values), then the parser
|
|
# should not trigger any asserts, but the resulting event could indicate
|
|
# the strangeness (i.e. byte_count != 2*|registers|).
|
|
|
|
event modbus_read_input_registers_request(c: connection, headers: ModbusHeaders, start_address: count, quantity: count)
|
|
{
|
|
print "modbus_read_input_registers_request", c$id, headers, start_address, quantity;
|
|
}
|
|
|
|
event modbus_read_input_registers_response(c: connection, headers: ModbusHeaders, byte_count: count, registers: ModbusRegisters)
|
|
{
|
|
print "modbus_read_input_registers_response", c$id, headers, registers, |registers|, byte_count;
|
|
}
|