https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16470
--- Comment #10 from Guy Harris <ghar...@sonic.net> ---
Please note, by the way, that the pcapng file attached to the bug is invalid.
To quote section 3.1 "General Block Structure":
http://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?url=https://raw.githubusercontent.com/pcapng/pcapng/master/draft-tuexen-opsawg-pcapng.xml&modeAsFormat=html/ascii&type=ascii#rfc.section.3.1
of the current version of the pcapng spec:
Block Total Length (32 bits): an unsigned value giving the total size of
this block, in octets. For instance, the length of a block that does not have a
body is 12 octets: 4 octets for the Block Type, 4 octets for the initial Block
Total Length and 4 octets for the trailing Block Total Length. *This value MUST
be a multiple of 4.*
Note the last sentence.
Block 6 has a length of 646 bytes; that is *not* a multiple of 4. Wireshark's
pcapng reader *happens* to round block lengths that are not a multiple of 4 up
to the next multiple of 4, but there is *no* guarantee that all pcapng readers
will do so - in fact, at least one is known *not* to do so.
If that was written by code maintained by you or your organization, please fix
it. If it wasn't, please report the bug to the people who *do* maintain it,
telling them that it violates the pcapng spec and must be fixed.
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
