rusticata / pcap-parser

PCAP/PCAPNG file format parser written in pure Rust. Fast, zero-copy, safe.
Other
104 stars 24 forks source link

Infinite loop happens when pcap files with truncated packet #20

Closed op8867555 closed 1 year ago

op8867555 commented 1 year ago

Hi, I followed the example and found out that a truncated packet will make the example parser stuck in an infinite loop, since:

My current workaround is checking reader_exhausted() after every refill() calls.

Err(PcapError::Incomplete) => {
    reader.refill().unwrap();
    if reader.reader_exhausted() { break; }
},

Is this behavior expected or a bug?

chifflier commented 1 year ago

Hi, This example was indeed incomplete, and was missing the code to handle incomplete blocks.

This is a duplicate of #18 and fixed in b4a526f3404380f63624ef862c95450a8571e6e7 (see these links for complete examples). Closing this issue as it is now fixed.