Re: pcap files with file header snaplen < packet

[Jefferson Ogata <Jefferson.Ogata () noaa gov>]

Aaron Turner wrote:
> Perhaps I'm confused... how does an application using the libpcap API
> get access to the snaplen?   I don't see any way to do that.

int pcap_snapshot (pcap_t *)

> Furthermore, all the libpcap functions seem to return a pointer to the
> packet buffer, and said buffer is allocated by libpcap, not the
> application.  I guess I don't see the danger.

Yes, but an application could have allocated another buffer to copy that
into based on snap. Of course it should check caplen, but there are a
lot of lousy programmers out there.

Like I say, I could go either way. But I think there is a potential problem.

-- 
Jefferson Ogata <Jefferson.Ogata () noaa gov>
NOAA Computer Incident Response Team (N-CIRT) <ncirt () noaa gov>
"Never try to retrieve anything from a bear."--National Park Service
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.