cisagov / icsnpp-bacnet

Zeek BACnet Parser - CISA ICSNPP
BSD 3-Clause "New" or "Revised" License
15 stars 11 forks source link

Handle case where bacnet property value is set to a non-numeric value #5

Closed mmguero closed 2 years ago

mmguero commented 2 years ago

Handle case where bacnet property value is set to a non-numeric value (such as 'PropertyError') to prevent a to_count error on a string value

Signed-off-by: Seth Grover mero.mero.guero@gmail.com

There are some cases where a property_value may get passed into the Zeek side from the binpac side set to a string value like PropertyError. In bacnet_write_property and bacnet_write_property it will attempt to convert this to a count value using to_count, which will result in this error:

bad conversion to count (to_count(Bacnet::property_value) and PropertyError)

This fix double-checks to make sure the property_value is a numeric character before doing the lookup, otherwise it stores the string as-is.