pcap_parser::LegacyPcapReader handles short reads poorly.

rusticata / pcap-parser

PCAP/PCAPNG file format parser written in pure Rust. Fast, zero-copy, safe.

Other

104 stars 24 forks source link

pcap_parser::LegacyPcapReader handles short reads poorly. #15

Closed vi closed 2 years ago

vi commented 2 years ago

Feeding pcap file to the parser slowly and incrementally may lead to Error: Incomplete read or endless loop with PcapError::Incomplete without syscalls (despite of reader.refill().unwrap()).

vi commented 2 years ago

Swapping the parsing lib to pcap_file::PcapReader makes issues go away.

chifflier commented 2 years ago

Hi, I'm not sure, but this may be related to 7335348f9d5012089bf329032d716980e06e8865 A new minor release is due soon (including the above commit).

chifflier commented 2 years ago

0.13.1 is release, can you confirm if the problem is fixed? If not, can you provide more details and/or some code? Thanks

chifflier commented 2 years ago

Closing due to lack of new information. Bug should be fixed since 0.13.1, please reopen issue if needed.