Skip to content

fix(pcapng): an SHB or IDB shorter than its fixed fields rebuilds at full size #1422

Closed

Description

@JarryShaw

Describe the bug
A Section Header Block or Interface Description Block shorter than its fixed fields rebuilds at the full fixed size. The parser over-reads past the declared Block Total Length.

To Reproduce
On main (ec2ba13a4), run PCAPNG.from_data(PCAPNG(raw).info).data:

  • SHB with a body of only the byte-order magic (length 16): 16 → 28 octets.
  • SHB with magic + version (length 20): 16 → 28 octets.
  • IDB of length 12 (empty body) or 16 (linktype + reserved only): rebuilds as 20.
  • A full SHB (28) and IDB (20) are exact.

Expected behavior
Byte-exact, per the every-round-trip ruling. Keep the block body as captured, as #1420 does for EPB/PB under 32 octets (block_raw).

Found by the #1420 cross-review. Blocked until #1420 merges, since both edit protocols/misc/pcapng.py.

Activity

  1. added
    fixPull requests that fix a defect (fix: subject prefix)
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 8, 2026
  2. JarryShaw commented on Oct 8, 2026

    @JarryShaw
    OwnerAuthor

    Unblocked: #1420 merged (6c44166e0). A worker is on it now, branch fix/1422-pcapng-short-shb-idb.

  3. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 8, 2026
  4. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 8, 2026
  5. added this to the PyPCAPKit v1.5 milestone on Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    fixPull requests that fix a defect (fix: subject prefix)

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions