Repository navigation
fix(pcapng): an unknown, custom or journal block cut off past the zero-pad limit aborts extraction #1984
Description
An unknown block, a Custom Block or a systemd journal export block whose Block Total Length is above config.MAX_ZERO_PAD_LENGTH (0x40000) and runs past the end of the file aborts extract. Every earlier frame is lost.
- Repro (on
main,engine='default'): build SHB + IDB + EPB +struct.pack('<II', 0x77, 0x7FFFFFF0) + bytes(8). Block types 9 and 0xBAD fail the same way. - Result:
FieldValueError: Field body declares a length of 2147483620 octet(s)…, raised fromSchema.unpack. The failing field isbody,dataorentry, depending on the block type. - Contrast: EPB, IDB, ISB, NRB and SPB in the same position are rescued by
PCAPNG.read's_read_block_cutfallback. So are these three block types when the length is below the zero-pad limit, for example 0x10000.
Fix: cut a block that the file truncates the same way for every type, so its fields are sized from the octets actually held, and extraction keeps the frames before it.
Activity
JarryShaw commentedon Oct 20, 2026
Blocked until #1979 merges. The fix belongs in
PCAPNG.read's block-cut path, which #1979 is rewriting.JarryShaw commentedon Oct 20, 2026
#1979 has merged, so this is unblocked. A worker has started.
test(pcapng): drop timed wording from the #1984 test (#1984)