From 914bac185be82adaec74758e37a7e6de4302153b Mon Sep 17 00:00:00 2001
From: NK <nk@localhost.localdomain>
Date: Fri, 4 Sep 2026 23:34:22 +0530
Subject: [PATCH] zigbee: fix ZCLPricePublishPrice rate_label dissection

rate_label used a self-referential length callback,
int(pkt.rate_label[0]), which reads the field before it is set, so
dissecting the command always raised IndexError and the packet could
never be parsed.

Per review, replace it with the standard pair: a FieldLenField carrying
the length octet and a StrLenField sized from it through length_from.

AI-Assisted: yes (Claude)
---
 scapy/layers/zigbee.py        |  9 +++++----
 test/scapy/layers/dot15d4.uts | 16 ++++++++++++++++
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/scapy/layers/zigbee.py b/scapy/layers/zigbee.py
index 8531ca6f79d..f57986c1e7c 100644
--- a/scapy/layers/zigbee.py
+++ b/scapy/layers/zigbee.py
@@ -14,9 +14,9 @@
 
 from scapy.packet import bind_layers, bind_bottom_up, Packet
 from scapy.fields import BitField, ByteField, XLEIntField, ConditionalField, \
-    ByteEnumField, EnumField, BitEnumField, FieldListField, FlagsField, \
-    IntField, PacketListField, ShortField, StrField, StrFixedLenField, \
-    StrLenField, XLEShortField, XStrField
+    ByteEnumField, EnumField, BitEnumField, FieldLenField, FieldListField, \
+    FlagsField, IntField, PacketListField, ShortField, StrField, \
+    StrFixedLenField, StrLenField, XLEShortField, XStrField
 
 from scapy.layers.dot15d4 import dot15d4AddressField, Dot15d4Beacon, Dot15d4, \
     Dot15d4FCS
@@ -1323,7 +1323,8 @@ class ZCLPricePublishPrice(Packet):
     fields_desc = [
         XLEIntField("provider_id", 0x00000000),  # Unsigned 32-bit Integer (4 octets)  # noqa: E501
         # Rate Label is a UTF-8 encoded Octet String (0-12 octets). The first Octet indicates the length.  # noqa: E501
-        StrLenField("rate_label", "", length_from=lambda pkt:int(pkt.rate_label[0])),  # TODO verify  # noqa: E501
+        FieldLenField("rate_label_len", None, length_of="rate_label", fmt="<B"),
+        StrLenField("rate_label", "", length_from=lambda pkt: pkt.rate_label_len),
         XLEIntField("issuer_event_id", 0x00000000),  # Unsigned 32-bit Integer (4 octets)  # noqa: E501
         XLEIntField("current_time", 0x00000000),  # UTCTime (4 octets)
         ByteField("unit_of_measure", 0),  # 8 bits enumeration (1 octet)
diff --git a/test/scapy/layers/dot15d4.uts b/test/scapy/layers/dot15d4.uts
index 15ad74de801..3b6e367a66f 100644
--- a/test/scapy/layers/dot15d4.uts
+++ b/test/scapy/layers/dot15d4.uts
@@ -948,3 +948,19 @@ assert ZCLIASZoneZoneEnrollResponse in pkt.layers()
 assert pkt[ZCLIASZoneZoneEnrollResponse].rsp_code == 0x00
 assert pkt[ZCLIASZoneZoneEnrollResponse].zone_id == 0x3a
 assert raw(pkt[ZCLIASZoneZoneEnrollResponse].payload) == b''
+
+= Zigbee - ZCL Price Publish Price rate label
+
+data = bytes.fromhex("1122334404616263645566778899aabbcc01ccdd0203445566778899aabbccdd112233445566778899aabbccddee")
+p = ZCLPricePublishPrice(data)
+assert p.provider_id == 0x44332211
+assert p.rate_label_len == 4
+assert p.rate_label == b"abcd"
+assert p.issuer_event_id == 0x88776655
+assert p.current_time == 0xCCBBAA99
+assert p.price == 0xDDCCBBAA
+assert p.price_ratio == 0x11
+assert p.generation_price == 0x55443322
+assert p.number_of_block_thresholds == 0xDD
+assert p.price_control == 0xEE
+assert raw(p) == data