fix(pcapng): SPB data past original_len and EPB/PB under the minimum length do not rebuild byte-exactly

Describe the bug
Two PCAP-NG packet blocks still lose octets on rebuild.

SPB: a Simple Packet Block that holds more data than its original_len loses the excess. fix(pcapng): a Simple Packet Block longer than the snaplen is silently truncated on parse #1384 covers only the snaplen case.
EPB/PB: with a Block Total Length below the 32-octet minimum, the block rebuilds at 32.

To Reproduce

An SPB with original_len=3 and 8 data octets, on fix(pcapng)!: PCAP-NG round-trip follow-ups (#1382, #1383, #1384, #1401, #1405, #1406) #1412's head 0514d5c30: 24 octets in, 20 out (abcdefgh becomes abc\0).
The EPB/PB case is identical on main.

Expected behavior
Byte-exact per the every-round-trip ruling: keep the octets as captured.

Found by the #1412 cross-review; I reproduced the SPB case. Blocked until #1412 merges.

Unblocked: #1412 merged (ec2ba13a4). A worker is on it now.

fix(pcapng)!: keep malformed journal entries and short packet blocks …

Navigation Menu