file-pcapng: redo the way we dissect the data in blocks.

Create a tvbuff that covers the data portion of a block, and use that to
dissect all data in the block, including but not limited to the options.

Catch ReportedBoundsError exceptions and treat them as an indication
that the block length was too short - add an expert info to the block
length item indicating that.

Have separate routines for each block type that dissects the data in
that block type.

While we're at it, check whether the trailing block length is equal to
the  header block length and, if not, report an error in the trailing
block length.

Fix the tests to match.
This commit is contained in:
Guy Harris 2021-06-04 16:26:45 -07:00
parent deb6786ed4
commit eaa4a7022b
2 changed files with 563 additions and 399 deletions

File diff suppressed because it is too large Load Diff

View File

@ -243,6 +243,9 @@ class case_fileformat_mime(subprocesstest.SubprocessTestCase):
proc = self.assertRun((cmd_tshark,
'-r', capture_file('icmp.pcapng.gz'),
'-Xread_format:MIME Files Format',
'-Tfields', '-e', 'frame.len', '-e', 'pcapng.block.length',
'-Tfields',
'-e', 'frame.len',
'-e', 'pcapng.block.length',
'-e', 'pcapng.block.length_trailer',
))
self.assertEqual(proc.stdout_str.strip(), '480\t128,128,88,88,132,132,132,132')
self.assertEqual(proc.stdout_str.strip(), '480\t128,88,132,132\t128,88,132,132')