Repository navigation
fix(pcapng): cut an unknown, custom or journal block the file truncates (#1984) - #1988
Merged
Merged
Conversation
…es (#1984) - UnknownBlock.body, CustomBlock.data and SystemdJournalExportBlock.entry are each one BytesField sized from the Block Total Length. A length past the end of the file made that field declare the missing octets: within the zero-pad ceiling they were zero-filled, past it FieldValueError was raised inside the header schema, outside PCAPNG.read's _read_block_cut fallback, and the extraction lost every earlier frame. - The new held_body callback bounds the span by what is left of the stream, so the body is the octets the file holds and PCAPNG.read reports the truncation as it does for every other block type. It is a no-op on well-formed blocks and on the packing path. - Tests cover all three types above and below the ceiling, and check the earlier frames, the warning, the held body, and byte-exact rebuilds. Closes #1984
JarryShaw
added
the
review: running
Owner
Author
|
GOOD TO GO at |
JarryShaw
added
review: good-to-go
Contributor
|
Coverage: 91.53% (unit tier, Python 3.15,
Per-file detail: the |
JarryShaw
removed
the
review: good-to-go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
make pylint,make mypy,make isort)make testpasses, and a test case covers the changeWhat is the purpose of your pull request?
fix— a bug fixDescription of your pull request and other information
An unknown block, Custom Block or systemd journal export block that the file cuts short no longer aborts extraction.
BytesFieldsized from the Block Total Length alone. PastMAX_ZERO_PAD_LENGTH, that field raisesFieldValueErrorduringPCAPNG.unpack, which happens beforePCAPNG.read's_read_block_cutfallback can step in.held_body, now caps all three bodies at the octets the stream still holds. The block then gets the same "block truncated" warning as EPB/IDB/ISB/NRB/SPB, and the earlier frames survive. Below the limit, a cut block holds its captured octets in place of a zero-padded body. Well-formed blocks and builds are unchanged.test_pcapng_cut_block_past_eof_1984_unit.pyfails onmain(12 failed) and passes here. Round trips stay byte-exact.Closes #1984