Repository navigation
fix(toolkit): the pypcapfile engine accepts an IPv4 IHL that runs past the packet #1591
Description
With engine='pypcapfile', an IPv4 header whose IHL runs past the packet still produces an IPv4 input. The default engine rejects the header.
Repro on main, 3.11, pypcapfile 0.12.0: IPv4 with IHL 15 (a 60-octet header) inside a 40-octet packet, DF clear.
- Default engine: no IPv4 input (
pcapkit/protocols/internet/ipv4.py:327rejects it). - pypcapfile: an IPv4 input with a 40-octet header.
Cause: pcapfile's IP (pcapfile/protocols/network/ip.py:50-52) slices without a bounds check, and _network (pcapkit/toolkit/pypcapfile.py:325) and ipv4_reassembly (:635-641) accept the result as it is.
Expected: an IHL past the captured packet gives no IPv4 input, or the same decode warning as the default engine.
Found by the #1575 worker and confirmed by its cross-review. Blocked until #1575 merges.
Activity
JarryShaw commentedon Oct 10, 2026
Work has started ahead of #1575 merging, together with #1590–#1593 and #1596 because all five are in the same
pypcapfile.pyheader walk. It is on a branch built on #1575's head1de91947b. The PR opens, rebased ontomain, once #1575 merges.fix(toolkit): pypcapfile checks IPv4 and TCP headers as the default e…
fix(toolkit): pypcapfile checks IPv4 and TCP headers as the default e…
fix(toolkit): pypcapfile checks IPv4 and TCP headers as the default e…
refactor(toolkit): revert pypcapfile's agreement-only code (#1708) (#…