pcap-parser icon indicating copy to clipboard operation
pcap-parser copied to clipboard

`create_reader` always returns `ReadError` if read operation of the underlying reader gives large output

Open messense opened this issue 4 months ago • 0 comments

When using pcap-parser with zstd streaming decoder create_reader(1024 * 1024, <zstd reader>)

https://github.com/rusticata/pcap-parser/blob/c35ce738442cb10fd7e22ea4ee54a3102c2e4143/src/capture.rs#L40-L45

the zstd decoder read operation can pull 1024 * 1024 bytes to the buffer which makes the buffer full, then in https://github.com/rusticata/pcap-parser/blob/c35ce738442cb10fd7e22ea4ee54a3102c2e4143/src/pcap/reader.rs#L94-L100

pcap-parser tries to read again, but because there is no space left in the buffer, zstd decoder read operation now throws Operation made no progress over multiple calls, due to output buffer being full error, which turns into PcapError::ReadError. (BTW it'd be nice if PcapError::ReadError carries over the original std::io::Error.)

This problem seems to apply to both legacy pcap and pcapng.

I think the fix could be only call read when buffer.available_data() < 24 (where 24 is pcap header length).

messense avatar Aug 13 '25 05:08 messense