zeek/testing/btest/scripts/base/protocols/modbus/length_mismatch.zeek
Robin Sommer 789cb376fd GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev.
This also installs symlinks from "zeek" and "bro-config" to a wrapper
script that prints a deprecation warning.

The btests pass, but this is still WIP. broctl renaming is still
missing.

#239
2019-05-01 21:43:45 +00:00

14 lines
674 B
Text

# The parser generated by BinPAC needs to handle this pcap without crashing
# or asserting. Specifically, pasing Function Code 23,
# ReadWriteMultipleRegistersRequest, has a field:
#
# uint16[write_quantity] &length=write_byte_count;
#
# And the pcap has mismatching values for those quantities.
# The use of &length on arrays previously caused array elements to
# be treated as already having a bounds check in the parsing-loop, which
# is problematic in the case where (write_quantity * 2) > write_byte_count
# as that can cause reading from a location that exceeds the end of the
# data buffer.
# @TEST-EXEC: zeek -r $TRACES/modbus/4SICS-GeekLounge-151022-min.pcap