You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(protocols): a later IPv4 fragment's data is dissected as the upper-layer header #1553
Describe the bug
A later IPv4 fragment, one with a non-zero Fragment Offset, has its payload dissected as if it began with the upper-layer header. The payload is really mid-datagram data. This is the IPv4 counterpart of #1545.
Reproduction IPv4(bytes(IPv4(protocol='UDP', offset=185, payload=Raw(bytes(range(40))), src='1.1.1.1', dst='2.2.2.2'))) re-parses as IPv4:UDP:Raw, with a fragment offset of 1480. The 8 payload octets at the start are read as a UDP header.
Expected behavior
Leave the data of a later fragment as Raw and decode no upper layer, as #1545's fix (PR #1552) does for IPv6 and as Wireshark does. A first fragment, offset 0 with MF set, is still dissected. Reassembly and every round trip are unchanged.
System information
Linux, CPython 3.14.7, main at 16fbea054.
Additional context pcapkit/protocols/internet/ipv4.py never consults the offset before decoding the next layer. Found by the #1545 author. This is blocked until #1547's PR merges, because that PR is editing the same payload-length path in ipv4.py.
Unblocked: #1554 has merged (total_length 0 handling in ipv4.py). A worker is now fixing this in pcapkit/protocols/internet/ipv4.py, following #1552's IPv6 approach.
Activity
JarryShaw commentedon Oct 10, 2026
Unblocked: #1554 has merged (
total_length0 handling inipv4.py). A worker is now fixing this inpcapkit/protocols/internet/ipv4.py, following #1552's IPv6 approach.fix(protocols): a later IPv4 fragment's data is raw, not an upper-lay…