Re: libpcap-0.6.1
libpcap doesn't seem to be completely large file safe. Specifically,
in each of the pcap-{dlpi,null,etc}.c files the {interface-name}_kread
function read(); is called with a return to type int.
In other words, in pcap-dlpi.c, line 1001 there is:
cc = read(fd, buf, len);
where cc is of type register int. It should be register ssize_t so
when large file support is -D efined everything is safe.
example diff:
dbrumley@sunset> diff pcap-dlpi.c pcap-dlpi.c.orig
994c994
< register ssize_t cc;
---
> register int cc;
BTW, for solaris the define is:
-D_FILE_OFFSET_BITS=64
to make an app large file safe (according to:
http://ftp.sas.com/standards/large.file/)
not a big deal, but often we have argus files (which use libpcap)
which are over 2 GB. I haven't thoroughly checked the source to see
if it's large file safe, but I noticed this one right off.
Cheers,
david
--
#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#
David Brumley - Stanford Computer Security - dbrumley at Stanford.EDU
Phone: +1-650-723-2445 WWW: http://www.stanford.edu/~dbrumley
Fax: +1-650-725-9121 PGP: finger dbrumley-pgp at sunset.Stanford.EDU
#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#
Fact: you can burn 150 caloria per hour banging your head against a wall
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
