Repository navigation
fix(foundation): a record length above sys.maxsize crashes Frame.read with OverflowError on 32-bit-Py_ssize_t builds #1975
Description
A crafted PCAP whose record header declares incl_len of 2**31 - 16 or more crashes Frame.read with OverflowError. This happens on any build where sys.maxsize is 2**31 - 1: GraalPy and 32-bit CPython. The declared length goes straight into a read or seek that takes a Py_ssize_t, so the overflow fires before the existing short-read handling can reject the record.
It was found while sorting #1963's GraalPy failures. #1974 only gates the two #1541 subtests that hit it, skipping the claims above sys.maxsize. The pcapkit side is unfixed.
Fix: audit every read and seek driven by a declared length in the PCAP and PCAPNG engines. Clamp or reject claims above what a single read can take, so a hostile claim gets the same malformed-record handling on every build. Then lift the #1974 gate.
Activity
JarryShaw commentedon Oct 20, 2026
Blocked until #1974 merges, since the gate this fix lifts lives there.
JarryShaw commentedon Oct 20, 2026
#1974 has merged, so this is unblocked. A worker is auditing the PCAP and PCAPNG length-driven reads and seeks, handling claims above
sys.maxsizeas overruns on every build, and lifting #1974's gates on the two #1541 subtests.fix(protocols): cite #1975 as #NNN in plain comments (#1975)
fix(protocols): advance past a record longer than sys.maxsize instead…