Merge pull request #873 in SNORT/snort3 from Bug201617 to master

Squashed commit of the following:

commit 501c5def6b7be582d9fe4d18bcd991a89f361e80
Author: allewi <allewi@cisco.com>
Date:   Fri Apr 28 09:55:11 2017 -0400

    adding changes from 2.x to correct false positives on modbus with a bad length

diff --git a/src/service_inspectors/modbus/modbus_decode.cc b/src/service_inspectors/modbus/modbus_decode.cc
index ff8a27174d7749570e7a5567d2123fae7a566cb2..f3c8ec570d93d3893db342a6085fc7edd629611d 100644 (file)
--- a/src/service_inspectors/modbus/modbus_decode.cc
+++ b/src/service_inspectors/modbus/modbus_decode.cc
@@ -263,7 +263,7 @@ static void ModbusCheckResponseLengths(modbus_session_data_t* session, Packet* p
         {
             /* count of 2-byte registers*/
             tmp_count = *(p->data + MODBUS_MIN_LEN);
-            if (modbus_payload_len == MODBUS_BYTE_COUNT_SIZE + 2*tmp_count)
+            if (modbus_payload_len == MODBUS_BYTE_COUNT_SIZE + tmp_count)
                 check_passed = true;
         }
         break;