libmodbus
libmodbus copied to clipboard
A bug that violates the specification of the length field
Hi, I found a bug that violates the specification that the length field should adhere to.
Steps to reproduce(after installation):
- Terminal 1 - Server
cd libmodbus/tests
./unit-test-server
- Terminal 2 - Client
First, send one valid input:
b'\x00\x01\x00\x00\x00\x06\xff\x01\x01\x30\x00\x06Second, send invalid inputs that contain incorrect length field values:b'\x00\x01\x00\x00\x00\x00\xff\x01\x01\x30\x00\x06b'\x00\x01\x00\x00\x10\x00\xff\x01\x01\x30\x00\x063)Observe the server's outputs; we can see that they received the same positive response.b'\x00\x01\x00\x00\x00\x04\xff\x01\x01\x00
The Modbus/TCP protocol specification that the bug violates is as follows: