rusticata / pcap-parser

PCAP/PCAPNG file format parser written in pure Rust. Fast, zero-copy, safe.
Other
104 stars 24 forks source link

`nom::Err::Incomplete` returns total bytes instead of additional bytes #22

Closed gerard-ryan-immersaview closed 1 year ago

gerard-ryan-immersaview commented 1 year ago

When the ng_block_parse returns the nom::Err::Incomplete error, it returns the total number of bytes that are required for the header, at least in some cases. This is different from the nom::Err::Incomplete documented expectations which says it contains only the additional bytes required.

With the linked example this would mean

-            return Err(nom::Err::Incomplete(nom::Needed::new(P::HDR_SZ)));
+            return Err(nom::Err::Incomplete(nom::Needed::new(P::HDR_SZ - i.len())));

But it appears there is more than just that case.