Peter M. Groen / libmodbus

Commit ca3fcb1c98755e8f44c33a910af4db3c799ee63e

Authored by Stéphane Raimbault
1 parent 5ccdf5ef

Add unit tests for VD-1301 and VD-1302 vulnerabilities

Inline Side-by-side
Showing 1 changed file with 16 additions and 3 deletions
tests/unit-test-client.c
  View file @ca3fcb1
@@ -802,7 +802,6 @@ int test_server(modbus_t *ctx, int use_backend) @@ -802,7 +802,6 @@ int test_server(modbus_t *ctx, int use_backend)
802 goto close; 802 goto close;
803 } 803 }
804 804
805 - /* Modbus write and read multiple registers */  
806 rc = send_crafted_request(ctx, MODBUS_FC_WRITE_AND_READ_REGISTERS, 805 rc = send_crafted_request(ctx, MODBUS_FC_WRITE_AND_READ_REGISTERS,
807 rw_raw_req, RW_RAW_REQ_LEN, 806 rw_raw_req, RW_RAW_REQ_LEN,
808 MODBUS_MAX_WR_READ_REGISTERS + 1, 0, 807 MODBUS_MAX_WR_READ_REGISTERS + 1, 0,
@@ -810,8 +809,6 @@ int test_server(modbus_t *ctx, int use_backend) @@ -810,8 +809,6 @@ int test_server(modbus_t *ctx, int use_backend)
810 if (rc == -1) 809 if (rc == -1)
811 goto close; 810 goto close;
812 811
813 - /* Modbus write multiple registers with large number of values but a set a  
814 - small number of bytes in requests (not nb * 2 as usual). */  
815 rc = send_crafted_request(ctx, MODBUS_FC_WRITE_MULTIPLE_REGISTERS, 812 rc = send_crafted_request(ctx, MODBUS_FC_WRITE_MULTIPLE_REGISTERS,
816 write_raw_req, WRITE_RAW_REQ_LEN, 813 write_raw_req, WRITE_RAW_REQ_LEN,
817 MODBUS_MAX_WRITE_REGISTERS + 1, 6, 814 MODBUS_MAX_WRITE_REGISTERS + 1, 6,
@@ -826,6 +823,22 @@ int test_server(modbus_t *ctx, int use_backend) @@ -826,6 +823,22 @@ int test_server(modbus_t *ctx, int use_backend)
826 if (rc == -1) 823 if (rc == -1)
827 goto close; 824 goto close;
828 825
  826 + /* Modbus write multiple registers with large number of values but a set a
  827 + small number of bytes in requests (not nb * 2 as usual). */
  828 + rc = send_crafted_request(ctx, MODBUS_FC_WRITE_MULTIPLE_REGISTERS,
  829 + write_raw_req, WRITE_RAW_REQ_LEN,
  830 + MODBUS_MAX_WRITE_REGISTERS, 6,
  831 + backend_length, backend_offset);
  832 + if (rc == -1)
  833 + goto close;
  834 +
  835 + rc = send_crafted_request(ctx, MODBUS_FC_WRITE_MULTIPLE_COILS,
  836 + write_raw_req, WRITE_RAW_REQ_LEN,
  837 + MODBUS_MAX_WRITE_BITS, 6,
  838 + backend_length, backend_offset);
  839 + if (rc == -1)
  840 + goto close;
  841 +
829 /* Test invalid function code */ 842 /* Test invalid function code */
830 modbus_send_raw_request(ctx, invalid_fc_raw_req, INVALID_FC_REQ_LEN * sizeof(uint8_t)); 843 modbus_send_raw_request(ctx, invalid_fc_raw_req, INVALID_FC_REQ_LEN * sizeof(uint8_t));
831 rc = modbus_receive_confirmation(ctx, rsp); 844 rc = modbus_receive_confirmation(ctx, rsp);