Wireshark · Wireshark-dev: Re: [Wireshark-dev] size_t under Windows ...

[Guy Harris <guy@xxxxxxxxxxxx>]

On Nov 24, 2017, at 12:03 PM, Richard Sharpe <realrichardsharpe@xxxxxxxxx> wrote:

>   110>C:\buildbot\builders\windows-x86-64-petri-dish\windows-x86-64-petri-dish\build\dumpcap.c(2425):
> warning C4267: '=': conversion from 'size_t' to 'DWORD', possible loss
> of data
> 
> which seems to be cause by:
> 
>        pcap_src->cap_pipe_bytes_to_read = hdrsize;
> 
> and hdrsize is defined as size_t, so there is possible loss of range
> on Windows.

If hdrsize is larger than the largest possible DWORD value, the loss of range is not only possible, it's certain.

If hdrsize can be guaranteed not to be larger than the largest possible DWORD value, you can safely cast it to DWORD.

> hdrsize is set from a sizeof

Then perhaps it should be declared to be a DWORD on Windows.

Or perhaps we should just go with int, which should work on *all* platforms.

That does, however, mean that we need to handle reading packets with pcap, or blocks with pcapng, with a size > INT_MAX.

But we should *always* have been doing that, so as not to be tripped up by files, whether maliciously constructed or not, with records bigger than we're willing to handle.