Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 11483] New: pcapng: SPB capture length is incorrectly truncated if IDB snaplen

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	11483
Summary	pcapng: SPB capture length is incorrectly truncated if IDB snaplen = 0
Product	Wireshark
Version	1.99.x (Experimental)
Hardware	All
OS	All
Status	UNCONFIRMED
Severity	Normal
Priority	Low
Component	Capture file support (libwiretap)
Assignee	bugzilla-admin@wireshark.org
Reporter	hadrielk@yahoo.com

Created attachment 13833 [details]
example file showing the bug

Build Information:
Wireshark 1.99.9 (v1.99.9rc0-182-g61d1ea4 from master)

Copyright 1998-2015 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.17, with Cairo 1.14.2, with Pango 1.30.1, with
libpcap, without POSIX capabilities, with libz 1.2.8, with GLib 2.36.0, with
SMI
0.4.8, with c-ares 1.10.0, with Lua 5.2, with GnuTLS 2.12.19, with Gcrypt
1.5.0,
with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built Jul 24 2015
08:02:01), without AirPcap.

Running on Mac OS X 10.10.5, build 14F27 (Darwin 14.5.0), with locale
en_US.UTF-8, with libpcap version 1.5.3 - Apple version 47, with libz 1.2.5,
with GnuTLS 2.12.19, with Gcrypt 1.5.0.
Intel(R) Core(TM) i7-4980HQ CPU @ 2.80GHz (with SSE4.2)

Built using clang 4.2.1 Compatible Apple LLVM 6.1.0 (clang-602.0.53).
--
The pcapng file reader is setting a Simple Packet Block's capture length to 0
if the IDB's snaplen is 0, but an IDB snaplen of 0 means "no limit", so the
pcapng reader should be ignoring that.

The fix will need to be back-ported to 1.12 as well.

---

      You are receiving this mail because:

• You are watching all bug changes.