https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4755
Summary: Negative file size
Product: Wireshark
Version: 1.2.5
Platform: x86
OS/Version: Windows 7
Status: NEW
Severity: Minor
Priority: Low
Component: Extras
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: g.borello@xxxxxxxxx
Build Information:
wireshark 1.2.5 (SVN Rev 31296)
Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled with GTK+ 2.16.2, with GLib 2.20.3, with WinPcap (version unknown),
with libz 1.2.3, without POSIX capabilities, with libpcre 7.0, with SMI 0.4.8,
with c-ares 1.6.0, with Lua 5.1, with GnuTLS 2.8.1, with Gcrypt 1.4.4, with MIT
Kerberos, with GeoIP, with PortAudio V19-devel (built Dec 17 2009), with
AirPcap.
Running on 32-bit Windows 7, build 7600, without WinPcap, GnuTLS 2.8.1, Gcrypt
1.4.4, without AirPcap.
Built using Microsoft Visual C++ 9.0 build 30729
--
D:\captures>"c:\Program Files\Wireshark\capinfos.exe" net15full.acp
File name: net15full.acp
File type: Wireshark/tcpdump/... - libpcap
File encapsulation: Ethernet
Number of packets: 5854353
File size: -294965958 bytes
Data size: 3906331666 bytes
Capture duration: 3388 seconds
Start time: Fri May 11 14:04:36 2007
End time: Fri May 11 15:01:05 2007
Data byte rate: 1152841.40 bytes/sec
Data bit rate: 9222731.20 bits/sec
Average packet size: 667.25 bytes
Average packet rate: 1727.74 packets/sec
As you can see, the file size reported by the tool is a negative number, while
my file is 4.000.001.338 bytes.
I'm using Windows 7 (32 bit). The file is stored on a NTFS partition.
Now, reading some lines of code in capinfos.c, I noticed that the file size is
handled using a gint64 type, so there shouldn't be any problem.
Unfortunately, I don't have enough time to investigate, but it seems like file
size is somewhere managed as a 32 bit variable:
4.000.001.338 = 0xEE6B2D3A
Now, let's do an explicit cast from a 32 bit variable to a 64 bit variable,
doing sign extension:
(gint64) 0xEE6B2D3A = 0xFFFFFFFFEE6B2D3A = -294.965.958
And this is the same value capinfos is giving to me.
Unfortunately (again), I don't have enough time to test this minor issue on
another platforms.
Thank you for your work.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
