diff --git a/wiretap/pcapng.c b/wiretap/pcapng.c index c350532b3f..46662ee988 100644 --- a/wiretap/pcapng.c +++ b/wiretap/pcapng.c @@ -1090,12 +1090,6 @@ pcapng_read_packet_block(FILE_T fh, pcapng_block_header_t *bh, pcapng_t *pn, wta } } - if (packet.cap_len > packet.packet_len) { - *err = WTAP_ERR_BAD_FILE; - *err_info = g_strdup_printf("pcapng_read_packet_block: cap_len %u is larger than packet_len %u", - packet.cap_len, packet.packet_len); - return 0; - } if (packet.cap_len > WTAP_MAX_PACKET_SIZE) { *err = WTAP_ERR_BAD_FILE; *err_info = g_strdup_printf("pcapng_read_packet_block: cap_len %u is larger than WTAP_MAX_PACKET_SIZE %u", diff --git a/wiretap/wtap.c b/wiretap/wtap.c index 2d04375366..343a9b23c4 100644 --- a/wiretap/wtap.c +++ b/wiretap/wtap.c @@ -1075,5 +1075,23 @@ gboolean wtap_seek_read(wtap *wth, gint64 seek_off, struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info) { - return wth->subtype_seek_read(wth, seek_off, phdr, buf, err, err_info); + if (!wth->subtype_seek_read(wth, seek_off, phdr, buf, err, err_info)) + return FALSE; + + /* + * It makes no sense for the captured data length to be bigger + * than the actual data length. + */ + if (wth->phdr.caplen > wth->phdr.len) + wth->phdr.caplen = wth->phdr.len; + + /* + * Make sure that it's not WTAP_ENCAP_PER_PACKET, as that + * probably means the file has that encapsulation type + * but the read routine didn't set this packet's + * encapsulation type. + */ + g_assert(wth->phdr.pkt_encap != WTAP_ENCAP_PER_PACKET); + + return TRUE; }