Repository navigation
fix(pcapng): an EPB whose captured length runs past the block does not rebuild byte-exactly #1405
Description
Describe the bug
A PCAP-NG Enhanced Packet Block whose captured_len runs far past the block does not rebuild byte-exactly: 36 octets in, 41 out. bounded_area and nonnegative (pcapkit/protocols/schema/misc/pcapng.py) bound block-level spans, and the rebuild does not reproduce the captured octets.
To Reproduce
An EPB with captured_len greater than the block's remaining length, parsed and rebuilt through from_data. Found by the #1398 cross-review's PCAP-NG fuzz. It is identical on main, so #1398 does not cause it.
Expected behavior
Byte-exact, or a rejection that keeps the block as captured, per the every-round-trip ruling.
Blocked until #1398 merges, because it edits the same schema file.
Activity
JarryShaw commentedon Oct 8, 2026
Unblocked: #1398 (and #1400) have merged. One worker is taking all the PCAP-NG follow-ups together, #1382–#1384, #1401, #1405 and #1406, because they edit the same
pcapng.pyfiles.fix(pcapng)!: PCAP-NG round-trip follow-ups (#1382, #1383, #1384, #1401…