rusticata / pcap-parser

PCAP/PCAPNG file format parser written in pure Rust. Fast, zero-copy, safe.
Other
104 stars 24 forks source link

Early EOF even when the reader is not exhausted #30

Closed sunmy2019 closed 9 months ago

sunmy2019 commented 1 year ago

https://github.com/rusticata/pcap-parser/blob/a13bd1db2cf076969c2abb36c0d01a2b510c794a/src/capture_pcap.rs#L140-L145

circular::Buffer is possible to become position() == 0 and available_data() == 0 right after a consume call.

  /// advances the position tracker
  ///
  /// if the position gets past the buffer's half,
  /// this will call `shift()` to move the remaining data
  /// to the beginning of the buffer
  pub fn consume(&mut self, count: usize) -> usize {

This is causing an early EOF in the following demo, when the buffer is precisely consumed to zero.

loop {
    match reader.next() {
        Ok((offset, _block)) => {
            println!("got new block");
            num_blocks += 1;
            reader.consume(offset);
        },
        Err(PcapError::Eof) => break,
        Err(PcapError::Incomplete) => {
            reader.refill().unwrap();
        },
        Err(e) => panic!("error while reading: {:?}", e),
    }
}

a workaround for me would be

Err(PcapError::Eof) => {
    if reader.reader_exhausted() {
        break;
    } else {
        reader.refill().unwrap();
    }
}
chifflier commented 9 months ago

Hi, I was able to reproduce the problem here. I'm working on a fix.

sunmy2019 commented 8 months ago

I almost forget about this. 😄