Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 10037] Pcap-ng PB/EPB with caplen > len shouldn't be treated as an error

[bugzilla-daemon@xxxxxxxxxxxxx]

Guy Harris changed bug 10037

What	Removed	Added
Status	CONFIRMED	RESOLVED
Component	Wireshark	Capture file support (libwiretap)
Hardware	x86	All
Resolution	---	FIXED
Summary	Dumpcap recognizes error where wireshark does not	Pcap-ng PB/EPB with caplen > len shouldn't be treated as an error
OS	Ubuntu	All

Comment # 7 on bug 10037 from Guy Harris

The code to read pcap files doesn't consider caplen > len an error; the code to
read pcap-ng files does.  dumpcap captures a pcap file from the pipe and writes
a pcap-ng file; Wireshark/TShark try to read that file and they report an
error.

There's no reason to treat that as an error - we can just work around it. 
(tcpdump, at least, doesn't treat it as an error; libpcap just passes the
lengths through for both pcap 2.4 and later and for pcap-ng.)

Fixed in:

    the trunk - I41fbcf54341ea0429cef875442ea1f1377177a5f

    1.10 branch - If8fe0c21ff4a3a57fbd0575d43306fa892d31a6a

    1.8 branch - I28908674d5a6ee4bb76e01cd4c7b463fa9d155f6

---

      You are receiving this mail because:

• You are watching all bug changes.