When using pcap-parser with zstd streaming decoder create_reader(1024 * 1024, <zstd reader>)
|
let mut buffer = Buffer::with_capacity(capacity); |
|
let sz = reader.read(buffer.space()).or(Err(PcapError::ReadError))?; |
|
if sz == 0 { |
|
return Err(PcapError::Eof); |
|
} |
|
buffer.fill(sz); |
the zstd decoder read operation can pull 1024 * 1024 bytes to the buffer which makes the buffer full, then in
|
pub fn from_buffer( |
|
mut buffer: Buffer, |
|
mut reader: R, |
|
) -> Result<LegacyPcapReader<R>, PcapError<&'static [u8]>> { |
|
let sz = reader.read(buffer.space()).or(Err(PcapError::ReadError))?; |
|
buffer.fill(sz); |
|
let (_rem, header) = match parse_pcap_header(buffer.data()) { |
pcap-parser tries to read again, but because there is no space left in the buffer, zstd decoder read operation now throws Operation made no progress over multiple calls, due to output buffer being full error, which turns into PcapError::ReadError. (BTW it'd be nice if PcapError::ReadError carries over the original std::io::Error.)
This problem seems to apply to both legacy pcap and pcapng.
I think the fix could be only call read when buffer.available_data() < 24 (where 24 is pcap header length).
When using pcap-parser with zstd streaming decoder
create_reader(1024 * 1024, <zstd reader>)pcap-parser/src/capture.rs
Lines 40 to 45 in c35ce73
the zstd decoder
readoperation can pull1024 * 1024bytes to the buffer which makes the buffer full, then inpcap-parser/src/pcap/reader.rs
Lines 94 to 100 in c35ce73
pcap-parsertries toreadagain, but because there is no space left in the buffer, zstd decoderreadoperation now throwsOperation made no progress over multiple calls, due to output buffer being fullerror, which turns intoPcapError::ReadError. (BTW it'd be nice ifPcapError::ReadErrorcarries over the originalstd::io::Error.)This problem seems to apply to both legacy pcap and pcapng.
I think the fix could be only call
readwhenbuffer.available_data() < 24(where24is pcap header length).