Make the checks and adjustment of the snapshot length module-dependent.

Also, initialize the snapshot length to 0, meaning "not specified", so
that the default snapshot length, if not specified, is also
module-dependent.

That way, D-Bus has a maximum and default of 128MB, as that's the
maximum message size, but other capture devices have the current
MAXIMUM_SNAPLEN, so we can handle full-size D-Bus messages without
advertising an overly-large snapshot length for other devices,
potentially causing libpcap and programs using it or reading libpcap
files to allocate overly-large buffers for other capture devices.

1 files changed, 11 insertions, 0 deletions

diff --git a/pcap-tc.c b/pcap-tc.c
index bedb4f6e..a4cde6c0 100644
--- a/pcap-tc.c
+++ b/pcap-tc.c
@@ -572,6 +572,17 @@ TcActivate(pcap_t *p)
 	}
 
 	/*
+	 * Turn a negative snapshot value (invalid), a snapshot value of
+	 * 0 (unspecified), or a value bigger than the normal maximum
+	 * value, into the maximum allowed value.
+	 *
+	 * If some application really *needs* a bigger snapshot
+	 * length, we should just increase MAXIMUM_SNAPLEN.
+	 */
+	if (p->snapshot <= 0 || p->snapshot > MAXIMUM_SNAPLEN)
+		p->snapshot = MAXIMUM_SNAPLEN;
+
+	/*
 	 * Initialize the PPI fixed fields
 	 */
 	pPpiHeader = (PPPI_HEADER)pt->PpiPacket;