Skip to content

fix(pcapng): a Simple Packet Block longer than the snaplen is silently truncated on parse #1384

Closed
#1412
Closed
fix(pcapng): a Simple Packet Block longer than the snaplen is silently truncated on parse#1384
#1412
Labels
fixPull requests that fix a defect (fix: subject prefix)
Milestone
PyPCAPKit v1.5

Description

@JarryShaw
JarryShaw
opened on Oct 7, 2026

An SPB with 16 data octets under an interface snaplen of 8 parses as 8 octets. The other 8 are dropped without an error, the trailing block length is not checked against them, and the rebuild differs from the input. main kept all 16. pcapng-06 says SnapLen determines the SPB data length, so the truncation is spec-shaped. The silent loss is not: keep the excess, or at least warn and record it.

Confirmed by the #1373/#1378 cross-reviews; present on main too, so not a regression of those PRs. Blocked until #1373 and #1378 merge (same PCAP-NG/PCAP modules).

Activity

  1. JarryShaw
    added
    fixPull requests that fix a defect (fix: subject prefix)
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 7, 2026
  2. JarryShaw
    added this to PyPCAPKiton Oct 7, 2026
  3. JarryShaw
    moved this to Blocked in PyPCAPKiton Oct 7, 2026

  4. JarryShaw commented on Oct 8, 2026

    @JarryShaw
    JarryShaw
    on Oct 8, 2026
    OwnerAuthor

    Still blocked, now on a different PR. #1378 has merged, but the PCAP-NG half of #1398 (#1325, strict option lengths) is about to edit the same PCAP-NG files. Blocked until #1398 merges.

  5. JarryShaw commented on Oct 8, 2026

    @JarryShaw
    JarryShaw
    on Oct 8, 2026
    OwnerAuthor

    Unblocked: #1398 (and #1400) have merged. One worker is taking all the PCAP-NG follow-ups together, #1382–#1384, #1401, #1405 and #1406, because they edit the same pcapng.py files.

  6. JarryShaw
    added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 8, 2026
  7. JarryShaw
    added a commit that references this issue on Oct 8, 2026

    fix(pcapng)!: PCAP-NG round-trip follow-ups (#1382, #1383, #1384, #1401…

    ec2ba13
  8. JarryShaw
    closed this as completedin #1412on Oct 8, 2026
  9. JarryShaw
    removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 8, 2026
  10. JarryShaw
    added 2 commits that reference this issue on Oct 8, 2026

    fix(pcapng)!: keep malformed journal entries and short packet blocks …

    f0565f7

    fix(pcapng)!: keep malformed journal entries and short packet blocks …

    6c44166
  11. JarryShaw
    added this to the PyPCAPKit v1.5 milestone on Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    fixPull requests that fix a defect (fix: subject prefix)

    Projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions