[
https://bro-tracker.atlassian.net/browse/BIT-250?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
grigorescu updated BIT-250:
---------------------------
Status: Merge Request (was: Open)
> Binpac wrong boundary check
> ---------------------------
>
> Key: BIT-250
> URL: https://bro-tracker.atlassian.net/browse/BIT-250
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: BinPAC
> Affects Versions: 1.5.2
> Reporter: lorenzo simionato
> Attachments: test.pac
>
>
> I'm trying to create a parser for a simple protocol, described by the
> following type:
> {noformat}
> type Test_PDU = record {
> header: uint32;
> msg_length: uint32;
> msg_data: uint32;
> } &byteorder=littleendian, &length=msg_length;
> {noformat}
> The code generated by BinPAC, when you compile the attached .pac file is
> wrong.
> In fact the code generated for the parsing of the message is something like:
> {noformat}
> switch ( buffering_state_ ) {
> case 0:
> ..........
> t_flow_buffer->NewFrame(8, false);
> buffering_state_ = 1;
> ..........
> break;
>
> case 1: {
> buffering_state_ = 2;
> // Checking out-of-bound for "Test_PDU:msg_data"
> if ( (t_begin_of_data + 8) + (4) > t_end_of_data )
> {
> // Handle out-of-bound condition
> throw ExceptionOutOfBound("Test_PDU:msg_data",
> (8) + (4),
> (t_end_of_data) - (t_begin_of_data));
> }
> // Parse "msg_length"
> msg_length_ = FixByteOrder(byteorder(), *((uint32 const *)
> ((t_begin_of_data + 4))));
> t_flow_buffer->GrowFrame(msg_length());
> }
> break;
> }
> {noformat}
> As you can see at first buffer's length is set to 8, than it will throw an
> ExceptionOutOfBound because 12>8.
> I've looked into the issue and i think that the problem is in the method:
> bool RecordField::AttemptBoundaryCheck(Output* out_cc, Env* env)
> (pac_record.cc)
> In this method the boundary check for the field "msg_length" leads to the
> boundary check of the field "msg_type", because
> quoting the comment on the method: "If my next field can check its boundary,
> then I don't have to check mine, and it will save me a boundary-check."
> As a temporary fix i commented out the "optimization" to check the next field
> in the AttemptBoundaryCheck method.
> How to fix this issue properly?
--
This message was sent by Atlassian JIRA
(v6.3-OD-06-017#6327)
_______________________________________________
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
