Repository navigation
fix(toolkit): the pypcapfile engine reads a TCP Data Offset below 5 as a 20-octet header #1590
Description
With engine='pypcapfile', a TCP segment whose Data Offset is below 5 is read as if its header were 20 octets. The default engine rejects such a segment.
Repro on main (e9f3340f7), Python 3.11, pypcapfile 0.12.0: Ethernet + IPv4 + a TCP header with Data Offset 4 and payload data.
- Default engine: no TCP datagram, because
pcapkit/toolkit/pcap.py:135-136drops a header shorter than 20 octets. - pypcapfile: one TCP datagram with payload
b'data', plus a flow.
Cause: pcapkit/toolkit/pypcapfile.py:724 and :797 compute max(tcp.data_offset, TCP_MIN_HEADER_LEN), and _transport (:467) checks only the length.
Expected: a Data Offset below 5 means no TCP input, as with the default engine.
Found by the #1575 worker and its cross-review; I reproduced it independently. Blocked until #1575 merges, because the fix is in the same file.
Activity
JarryShaw commentedon Oct 10, 2026
Work has started ahead of #1575 merging, together with #1590–#1593 and #1596 because all five are in the same
pypcapfile.pyheader walk. It is on a branch built on #1575's head1de91947b. The PR opens, rebased ontomain, once #1575 merges.fix(toolkit): pypcapfile checks IPv4 and TCP headers as the default e…
fix(toolkit): pypcapfile checks IPv4 and TCP headers as the default e…
fix(toolkit): pypcapfile checks IPv4 and TCP headers as the default e…
refactor(toolkit): revert pypcapfile's agreement-only code (#1708) (#…