[tcpdump-workers] Bug in libpcap ?

[Pierre-Yves Bonnetain]

   Hello you happy workers,

   I think I have found what could be a small bug in libpcap. I've
been
banging my head on the wall for a whole day trying to play with some
specific
tool to split my dump files. And using a hell of a lot "dump_open on
stdout".
   Well, it did not core dump, but... errr... it did not work properly
except
for the first time I called dump_open(cap_file, '-'). After a
following
dump_close, nothing got right.
   The problem seems to lie in savefile::dump_close, which always uses
fclose 
to close a dump file, whereas it should (ihmo) use close if dump_open
worked
on stdout (well, I'm not sure if I'm clear enough).
   My (very quick) patch is attached.

   Oh, BTW, I'm using libpcap 0.6.2.

   Maybe my patch isn't intelligent enough. It currently solves my
problem,
but I have not (yet) checked if it does not add a helluva lot of
others.

   Sincerely,

-- Pierre-Yves Bonnetain
   Networks and Computers Security -- B&A Consultants
   T�l +33 (0) 563 277 241 -- Fax +33 (0) 563 277 245
Common subdirectories: libpcap-0.6.2/CVS and libpcap-0.6.2-pyb/CVS
Only in libpcap-0.6.2-pyb: Makefile
Common subdirectories: libpcap-0.6.2/SUNOS4 and libpcap-0.6.2-pyb/SUNOS4
Common subdirectories: libpcap-0.6.2/bpf and libpcap-0.6.2-pyb/bpf
Only in libpcap-0.6.2-pyb: bpf_filter.c
Only in libpcap-0.6.2-pyb: config.cache
Only in libpcap-0.6.2-pyb: config.h
Only in libpcap-0.6.2-pyb: config.log
Only in libpcap-0.6.2-pyb: config.status
Common subdirectories: libpcap-0.6.2/lbl and libpcap-0.6.2-pyb/lbl
Only in libpcap-0.6.2-pyb: net
diff -c -b libpcap-0.6.2/savefile.c libpcap-0.6.2-pyb/savefile.c
*** libpcap-0.6.2/savefile.c    Thu Dec 21 11:29:23 2000
--- libpcap-0.6.2-pyb/savefile.c        Tue Mar 12 16:40:56 2002
***************
*** 246,251 ****
--- 246,257 ----
        { -1,                   -1 }
  };
 =20
+ /*
+   (dirty ?) hack to make dump_close work ok if reading from stdout.
+   March, 12th, 2002 - [EMAIL PROTECTED]
+  */
+ static int not_filep =3D 0;
+=20
  static int
  dlt_to_linktype(int dlt)
  {
***************
*** 590,604 ****
                return (NULL);
        }
 =20
!       if (fname[0] =3D=3D '-' && fname[1] =3D=3D '\0')
                f =3D stdout;
!       else {
                f =3D fopen(fname, "w");
                if (f =3D=3D NULL) {
                        snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
                            fname, pcap_strerror(errno));
                        return (NULL);
                }
        }
        (void)sf_write_header(f, linktype, p->tzoff, p->snapshot);
        return ((pcap_dumper_t *)f);
--- 596,612 ----
                return (NULL);
        }
 =20
!       if (fname[0] =3D=3D '-' && fname[1] =3D=3D '\0') {
                f =3D stdout;
!                 not_filep =3D 1;
!       } else {
                f =3D fopen(fname, "w");
                if (f =3D=3D NULL) {
                        snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
                            fname, pcap_strerror(errno));
                        return (NULL);
                }
+                 not_filep =3D 0;
        }
        (void)sf_write_header(f, linktype, p->tzoff, p->snapshot);
        return ((pcap_dumper_t *)f);
***************
*** 613,617 ****
                return-an-error;
        /* XXX should check return from fclose() too */
  #endif
!       (void)fclose((FILE *)p);
  }
--- 621,626 ----
                return-an-error;
        /* XXX should check return from fclose() too */
  #endif
!         if (not_filep) close((int)p);
!       else (void)fclose((FILE *)p);
  }