Wireshark-bugs: [Wireshark-bugs] [Bug 11452] Capinfos crashes on pcap-ng files with no IDBs
Comment # 5
on bug 11452
from Guy Harris
(In reply to Hadriel Kaplan from comment #4)
> I was originally going to ask on the pcapng list about whether an "empty"
> pcapng file could legitimately not have an IDB, because I was wondering
> about that scenario as well. But reading the draft it says the IDB is
> mandatory, and gives no such wiggle room for empty files. (i.e., files
> without any packet blocks)
>
> So are you saying the draft should be changed? I'm cool with that - I don't
> care which it is, I just need to know so I can fix the bug one way or the
> other.
Yes, I'd say the pcap-ng spec should be changed to note that. Pcap-ng readers
*already* need to check for references to interfaces for which there's no IDB
and fail cleanly, so they should be able to handle files with no IDBs but with
packet blocks or interface statistics blocks.
That does complicate the process of, for example, reading a pcap-ng file and
writing it as a file in some format that has a per-file capture type, i.e. that
would have to fail if the pcap-ng file has no IDBs, but there might be some
issues the code to handle output file formats that have a per-file capture type
currently anyway - what if you have a pcap-ng file whose first IDB is
LINKTYPE_ETHERNET but that has, after some Ethernet-header packets, another IDB
with a different link-layer header type? At least with a one-pass program, the
program would have to fail at that point.
You are receiving this mail because:
- You are watching all bug changes.
