Wireshark-bugs: [Wireshark-bugs] [Bug 12586] Error reading an externally generated CAP
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sat, 16 Jul 2016 21:10:31 +0000

changed bug 12586


What Removed Added
Status UNCONFIRMED RESOLVED
CC   pascal.quantin@gmail.com
Resolution --- NOTOURBUG

Comment # 3 on bug 12586 from 
We added extra checks to ensure that the incl_len field is not bigger than what
Wireshark supports (WTAP_MAX_PACKET_SIZE = 262144).

    if (hdr.hdr.incl_len > WTAP_MAX_PACKET_SIZE) {
        /*
         * Probably a corrupt capture file; return an error,
         * so that our caller doesn't blow up trying to allocate
         * space for an immensely-large packet.
         */
        *err = WTAP_ERR_BAD_FILE;
        if (err_info != NULL) {
            *err_info = g_strdup_printf("pcap: File has %u-byte packet, bigger
than maximum of %u",
                hdr.hdr.incl_len, WTAP_MAX_PACKET_SIZE);
        }
        return FALSE;
    } 

This field is NOT designed to store private information. As Jaap indicated,
libpcap was not designed for this, while pcapng was.

You are now hitting one of our heuristics to detect potential malformed capture
files (see https://code.wireshark.org/review/3808).

We are probably not wiling to change this.

You are receiving this mail because:
  • You are watching all bug changes.