Wireshark-bugs: [Wireshark-bugs] [Bug 10145] Save as pcapng results in corrupt file
Bill Meier
changed
bug 10145
| What |
Removed |
Added |
| Status |
IN_PROGRESS
|
RESOLVED
|
| Hardware |
x86-64
|
All
|
| Resolution |
---
|
FIXED
|
| OS |
Windows 7
|
All
|
Comment # 1
on bug 10145
from Bill Meier
Fixed in https://code.wireshark.org/review/#/c/2199/ ( ga3a6e4061 ).
The corruption was generated when the number of name resolution entries to be
saved to the pcapng file "Name Resolution Block" (NRB) exceeded the number
which could fit in a single NRB.
In this case, only the first 10818 entries could fit in the first NRB. Since
there were many more name resolution entries than this to be saved, multiple
NRBs needed to be written.
The logic for handling this case was slightly faulty causing an incorrect NRB
length to be written for each completely filled NRB.
Thanks for the bug report (and for the capture file).
This bug fix will available in the next release of Wireshark-1.10 (which will
not be available for some time). A Wireshark-1.10 Win64 "release candidate"
containing the fix should be available shortly in
http://www.wireshark.org/download/automated/win64/
However, I suggest you download a copy of Wireshark-1.12 (which should have a
"release candidate" available shortly).
Altho I haven't had the time to do a test with the (soon to be released)
Wireshark-1,12, a quick code inspection indicates that the code related to
saving Name Resolution Blocks in pcapng files has been rewritten and that the
bug does not exist in that code.
You are receiving this mail because:
- You are watching all bug changes.
