You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(pcapng): an SHB or IDB shorter than its fixed fields rebuilds at full size #1422
Describe the bug
A Section Header Block or Interface Description Block shorter than its fixed fields rebuilds at the full fixed size. The parser over-reads past the declared Block Total Length.
To Reproduce
On main (ec2ba13a4), run PCAPNG.from_data(PCAPNG(raw).info).data:
SHB with a body of only the byte-order magic (length 16): 16 → 28 octets.
SHB with magic + version (length 20): 16 → 28 octets.
IDB of length 12 (empty body) or 16 (linktype + reserved only): rebuilds as 20.
A full SHB (28) and IDB (20) are exact.
Expected behavior
Byte-exact, per the every-round-trip ruling. Keep the block body as captured, as #1420 does for EPB/PB under 32 octets (block_raw).
Found by the #1420 cross-review. Blocked until#1420 merges, since both edit protocols/misc/pcapng.py.
Activity
JarryShaw commentedon Oct 8, 2026
Unblocked: #1420 merged (
6c44166e0). A worker is on it now, branchfix/1422-pcapng-short-shb-idb.fix(pcapng)!: keep an SHB or IDB shorter than its fixed fields as cap…
fix(pcapng)!: keep an SHB or IDB shorter than its fixed fields as cap…