From 6d6094e3498254de69f4878502a97b7fa3028207 Mon Sep 17 00:00:00 2001 From: Guy Harris Date: Fri, 25 Apr 2014 10:44:11 -0700 Subject: [PATCH] Don't fail if a pcap-NG PB or EPB has caplen > actual len. We don't fail for other file types; there's no point in failing for pcap-NG. wtap_read() will ensure that caplen <= len. Make wtap_seek_read() ensure that caplen <= len as well. Fixes bug 10037. Change-Id: I41fbcf54341ea0429cef875442ea1f1377177a5f Reviewed-on: https://code.wireshark.org/review/1353 Reviewed-by: Guy Harris --- wiretap/pcapng.c | 6 ------ wiretap/wtap.c | 20 +++++++++++++++++++- 2 files changed, 19 insertions(+), 7 deletions(-) diff --git a/wiretap/pcapng.c b/wiretap/pcapng.c index c350532b3f..46662ee988 100644 --- a/wiretap/pcapng.c +++ b/wiretap/pcapng.c @@ -1090,12 +1090,6 @@ pcapng_read_packet_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, wta } } - if (packet.cap_len > packet.packet_len) { - *err = WTAP_ERR_BAD_FILE; - *err_info = g_strdup_printf("pcapng_read_packet_block: cap_len %u is larger than packet_len %u", - packet.cap_len, packet.packet_len); - return 0; - } if (packet.cap_len > WTAP_MAX_PACKET_SIZE) { *err = WTAP_ERR_BAD_FILE; *err_info = g_strdup_printf("pcapng_read_packet_block: cap_len %u is larger than WTAP_MAX_PACKET_SIZE %u", diff --git a/wiretap/wtap.c b/wiretap/wtap.c index 2d04375366..343a9b23c4 100644 --- a/wiretap/wtap.c +++ b/wiretap/wtap.c @@ -1075,5 +1075,23 @@ gboolean wtap_seek_read(wtap *wth, gint64 seek_off, struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info) { - return wth->subtype_seek_read(wth, seek_off, phdr, buf, err, err_info); + if (!wth->subtype_seek_read(wth, seek_off, phdr, buf, err, err_info)) + return FALSE; + + /* + * It makes no sense for the captured data length to be bigger + * than the actual data length. + */ + if (wth->phdr.caplen > wth->phdr.len) + wth->phdr.caplen = wth->phdr.len; + + /* + * Make sure that it's not WTAP_ENCAP_PER_PACKET, as that + * probably means the file has that encapsulation type + * but the read routine didn't set this packet's + * encapsulation type. + */ + g_assert(wth->phdr.pkt_encap != WTAP_ENCAP_PER_PACKET); + + return TRUE; }