Changeset 951

Timestamp:

08/25/06 13:59:24 (7 years ago)

Author:

perry

Message:

Deal with packets that are corrupt/truncated, since pcap doesn't have a way
of flagging packets as being "bad"

File:

• trunk/lib/format_pcap.c (modified) (2 diffs)

trunk/lib/format_pcap.c

@@ -326 +326 @@
                 }
         }
+
+        /* Corrupt packet, or other "non data" packet, so skip it */
+        if (trace_get_link(packet) == NULL) {
+                /* Return "success", but nothing written */
+                return 0;
+        }
+
         if (packet->trace->format == &pcap || 
                         packet->trace->format == &pcapint) {
@@ -341 +348 @@
                 /* trace_get_wire_length includes FCS, while pcap doesn't */
                 if (trace_get_link_type(packet)==TRACE_TYPE_ETH)
-                        pcap_pkt_hdr.len = trace_get_wire_length(packet)-4;
+                        if (trace_get_wire_length(packet) >= 4) { 
+                                pcap_pkt_hdr.len = 
+                                        trace_get_wire_length(packet)-4;
+                        }
+                        else {
+                                pcap_pkt_hdr.len = 0;
+                        }
                 else
                         pcap_pkt_hdr.len = trace_get_wire_length(packet);