Make sure the packet length isn't > WTAP_MAX_PACKET_SIZE.
[metze/wireshark/wip.git] / wiretap / peekclassic.c
index 028947af737675fda378d71279ccb8c9b3b95cc9..5cbefbb3944f819e5c7f4378a6d527de9af04208 100644 (file)
@@ -1,9 +1,9 @@
 /* peekclassic.c
- * Routines for opening files in what WildPackets calls the classic file
- * format in the description of their "PeekRdr Sample Application" (C++
- * source code to read their capture files, downloading of which requires
- * a maintenance contract, so it's not free as in beer and probably not
- * as in speech, either).
+ * Routines for opening files in what Savvius (formerly WildPackets) calls
+ * the classic file format in the description of their "PeekRdr Sample
+ * Application" (C++ source code to read their capture files, downloading
+ * of which requires a maintenance contract, so it's not free as in beer
+ * and probably not as in speech, either).
  *
  * As that description says, it's used by AiroPeek and AiroPeek NX prior
  * to 2.0, EtherPeek prior to 6.0, and EtherPeek NX prior to 3.0.  It
@@ -15,8 +15,6 @@
  *
  * Copyright (c) 2001, Daniel Thompson <d.thompson@gmx.net>
  *
- * $Id$
- *
  * Wiretap Library
  * Copyright (c) 1998 by Gilbert Ramirez <gram@alumni.rice.edu>
  *
@@ -40,7 +38,6 @@
 #include <string.h>
 #include "wtap-int.h"
 #include "file_wrappers.h"
-#include "buffer.h"
 #include "peekclassic.h"
 /* CREDITS
  *
@@ -137,25 +134,26 @@ static const peekclassic_encap_lookup_t peekclassic_encap[] = {
        (sizeof (peekclassic_encap) / sizeof (peekclassic_encap[0]))
 
 typedef struct {
-       struct timeval reference_time;
+       time_t reference_time;
 } peekclassic_t;
 
 static gboolean peekclassic_read_v7(wtap *wth, int *err, gchar **err_info,
     gint64 *data_offset);
 static gboolean peekclassic_seek_read_v7(wtap *wth, gint64 seek_off,
-    struct wtap_pkthdr *phdr, guint8 *pd, int length,
-    int *err, gchar **err_info);
+    struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info);
+static int peekclassic_read_packet_v7(wtap *wth, FILE_T fh,
+    struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info);
 static gboolean peekclassic_read_v56(wtap *wth, int *err, gchar **err_info,
     gint64 *data_offset);
 static gboolean peekclassic_seek_read_v56(wtap *wth, gint64 seek_off,
-    struct wtap_pkthdr *phdr, guint8 *pd, int length,
-    int *err, gchar **err_info);
+    struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info);
+static gboolean peekclassic_read_packet_v56(wtap *wth, FILE_T fh,
+    struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info);
 
-int
-peekclassic_open(wtap *wth, int *err, gchar **err_info)
+wtap_open_return_val peekclassic_open(wtap *wth, int *err, gchar **err_info)
 {
        peekclassic_header_t ep_hdr;
-       struct timeval reference_time;
+       time_t reference_time;
        int file_encap;
        peekclassic_t *peekclassic;
 
@@ -168,8 +166,12 @@ peekclassic_open(wtap *wth, int *err, gchar **err_info)
         *      and we may have to add more checks at some point.
         */
        g_assert(sizeof(ep_hdr.master) == PEEKCLASSIC_MASTER_HDR_SIZE);
-       wtap_file_read_unknown_bytes(
-               &ep_hdr.master, sizeof(ep_hdr.master), wth->fh, err, err_info);
+       if (!wtap_read_bytes(wth->fh, &ep_hdr.master,
+           (int)sizeof(ep_hdr.master), err, err_info)) {
+               if (*err != WTAP_ERR_SHORT_READ)
+                       return WTAP_OPEN_ERROR;
+               return WTAP_OPEN_NOT_MINE;
+       }
 
        /*
         * It appears that EtherHelp (a free application from WildPackets
@@ -194,15 +196,18 @@ peekclassic_open(wtap *wth, int *err, gchar **err_info)
                /* get the secondary header */
                g_assert(sizeof(ep_hdr.secondary.v567) ==
                        PEEKCLASSIC_V567_HDR_SIZE);
-               wtap_file_read_unknown_bytes(
-                       &ep_hdr.secondary.v567,
-                       sizeof(ep_hdr.secondary.v567), wth->fh, err, err_info);
+               if (!wtap_read_bytes(wth->fh, &ep_hdr.secondary.v567,
+                   (int)sizeof(ep_hdr.secondary.v567), err, err_info)) {
+                       if (*err != WTAP_ERR_SHORT_READ)
+                               return WTAP_OPEN_ERROR;
+                       return WTAP_OPEN_NOT_MINE;
+               }
 
                if ((0 != ep_hdr.secondary.v567.reserved[0]) ||
                    (0 != ep_hdr.secondary.v567.reserved[1]) ||
                    (0 != ep_hdr.secondary.v567.reserved[2])) {
                        /* still unknown */
-                       return 0;
+                       return WTAP_OPEN_NOT_MINE;
                }
 
                /*
@@ -239,7 +244,7 @@ peekclassic_open(wtap *wth, int *err, gchar **err_info)
                                /*
                                 * Assume this isn't a Peek classic file.
                                 */
-                               return 0;
+                               return WTAP_OPEN_NOT_MINE;
                        }
                        break;
 
@@ -252,14 +257,14 @@ peekclassic_open(wtap *wth, int *err, gchar **err_info)
                                 * some radio information.  Presumably
                                 * this is from AiroPeek.
                                 */
-                               file_encap = WTAP_ENCAP_IEEE_802_11_AIROPEEK;
+                               file_encap = WTAP_ENCAP_IEEE_802_11_WITH_RADIO;
                                break;
 
                        default:
                                /*
                                 * Assume this isn't a Peek classic file.
                                 */
-                               return 0;
+                               return WTAP_OPEN_NOT_MINE;
                        }
                        break;
 
@@ -267,7 +272,7 @@ peekclassic_open(wtap *wth, int *err, gchar **err_info)
                        /*
                         * Assume this isn't a Peek classic file.
                         */
-                       return 0;
+                       return WTAP_OPEN_NOT_MINE;
                }
 
 
@@ -293,17 +298,15 @@ peekclassic_open(wtap *wth, int *err, gchar **err_info)
                ep_hdr.secondary.v567.linkSpeed =
                    g_ntohl(ep_hdr.secondary.v567.linkSpeed);
 
-               /* Get the reference time as a "struct timeval" */
-               reference_time.tv_sec  =
-                   ep_hdr.secondary.v567.timeDate - mac2unix;
-               reference_time.tv_usec = 0;
+               /* Get the reference time as a time_t */
+               reference_time = ep_hdr.secondary.v567.timeDate - mac2unix;
                break;
 
        default:
                /*
                 * Assume this isn't a Peek classic file.
                 */
-               return 0;
+               return WTAP_OPEN_NOT_MINE;
        }
 
        /*
@@ -319,7 +322,7 @@ peekclassic_open(wtap *wth, int *err, gchar **err_info)
 
        case 5:
        case 6:
-               wth->file_type = WTAP_FILE_PEEKCLASSIC_V56;
+               wth->file_type_subtype = WTAP_FILE_TYPE_SUBTYPE_PEEKCLASSIC_V56;
                /*
                 * XXX - can we get the file encapsulation from the
                 * header in the same way we do for V7 files?
@@ -330,7 +333,7 @@ peekclassic_open(wtap *wth, int *err, gchar **err_info)
                break;
 
        case 7:
-               wth->file_type = WTAP_FILE_PEEKCLASSIC_V7;
+               wth->file_type_subtype = WTAP_FILE_TYPE_SUBTYPE_PEEKCLASSIC_V7;
                wth->file_encap = file_encap;
                wth->subtype_read = peekclassic_read_v7;
                wth->subtype_seek_read = peekclassic_seek_read_v7;
@@ -342,13 +345,60 @@ peekclassic_open(wtap *wth, int *err, gchar **err_info)
        }
 
        wth->snapshot_length   = 0; /* not available in header */
-       wth->tsprecision = WTAP_FILE_TSPREC_USEC;
+       wth->file_tsprec = WTAP_TSPREC_USEC;
+
+       return WTAP_OPEN_MINE;
+}
+
+static gboolean peekclassic_read_v7(wtap *wth, int *err, gchar **err_info,
+    gint64 *data_offset)
+{
+       int sliceLength;
+
+       *data_offset = file_tell(wth->fh);
+
+       /* Read the packet. */
+       sliceLength = peekclassic_read_packet_v7(wth, wth->fh, &wth->phdr,
+           wth->frame_buffer, err, err_info);
+       if (sliceLength < 0)
+               return FALSE;
+
+       /* Skip extra ignored data at the end of the packet. */
+       if ((guint32)sliceLength > wth->phdr.caplen) {
+               if (!file_skip(wth->fh, sliceLength - wth->phdr.caplen, err))
+                       return FALSE;
+       }
+
+       /* Records are padded to an even length, so if the slice length
+          is odd, read the padding byte. */
+       if (sliceLength & 0x01) {
+               if (!file_skip(wth->fh, 1, err))
+                       return FALSE;
+       }
+
+       return TRUE;
+}
 
-       return 1;
+static gboolean peekclassic_seek_read_v7(wtap *wth, gint64 seek_off,
+    struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info)
+{
+       if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
+               return FALSE;
+
+       /* Read the packet. */
+       if (peekclassic_read_packet_v7(wth, wth->random_fh, phdr, buf,
+           err, err_info) == -1) {
+               if (*err == 0)
+                       *err = WTAP_ERR_SHORT_READ;
+               return FALSE;
+       }
+       return TRUE;
 }
 
-static gboolean
-peekclassic_read_v7(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
+#define RADIO_INFO_SIZE        4
+
+static int peekclassic_read_packet_v7(wtap *wth, FILE_T fh,
+    struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info)
 {
        guint8 ep_pkt[PEEKCLASSIC_V7_PKT_SIZE];
 #if 0
@@ -363,66 +413,94 @@ peekclassic_read_v7(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
        guint64 timestamp;
        time_t tsecs;
        guint32 tusecs;
+       guint8 radio_info[RADIO_INFO_SIZE];
 
-       *data_offset = file_tell(wth->fh);
-
-       wtap_file_read_expected_bytes(ep_pkt, sizeof(ep_pkt), wth->fh, err,
-           err_info);
+       if (!wtap_read_bytes_or_eof(fh, ep_pkt, sizeof(ep_pkt), err, err_info))
+               return -1;
 
        /* Extract the fields from the packet */
 #if 0
-       protoNum = pntohs(&ep_pkt[PEEKCLASSIC_V7_PROTONUM_OFFSET]);
+       protoNum = pntoh16(&ep_pkt[PEEKCLASSIC_V7_PROTONUM_OFFSET]);
 #endif
-       length = pntohs(&ep_pkt[PEEKCLASSIC_V7_LENGTH_OFFSET]);
-       sliceLength = pntohs(&ep_pkt[PEEKCLASSIC_V7_SLICE_LENGTH_OFFSET]);
+       length = pntoh16(&ep_pkt[PEEKCLASSIC_V7_LENGTH_OFFSET]);
+       sliceLength = pntoh16(&ep_pkt[PEEKCLASSIC_V7_SLICE_LENGTH_OFFSET]);
 #if 0
        flags = ep_pkt[PEEKCLASSIC_V7_FLAGS_OFFSET];
 #endif
        status = ep_pkt[PEEKCLASSIC_V7_STATUS_OFFSET];
-       timestamp = pntohll(&ep_pkt[PEEKCLASSIC_V7_TIMESTAMP_OFFSET]);
+       timestamp = pntoh64(&ep_pkt[PEEKCLASSIC_V7_TIMESTAMP_OFFSET]);
 
        /* force sliceLength to be the actual length of the packet */
        if (0 == sliceLength) {
                sliceLength = length;
        }
+       /*
+        * The maximum value of sliceLength and length are 65535, which
+        * are less than WTAP_MAX_PACKET_SIZE will ever be, so we don't
+        * need to check them.
+        */
 
-       wth->phdr.presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
-       
-       /* fill in packet header length values before slicelength may be
-          adjusted */
-       wth->phdr.len    = length;
-       wth->phdr.caplen = sliceLength;
-
-       if (sliceLength % 2) /* packets are padded to an even length */
-               sliceLength++;
+       /* fill in packet header values */
+       phdr->rec_type = REC_TYPE_PACKET;
+       phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
+       tsecs = (time_t) (timestamp/1000000);
+       tusecs = (guint32) (timestamp - tsecs*1000000);
+       phdr->ts.secs  = tsecs - mac2unix;
+       phdr->ts.nsecs = tusecs * 1000;
+       phdr->len    = length;
+       phdr->caplen = sliceLength;
 
        switch (wth->file_encap) {
 
-       case WTAP_ENCAP_IEEE_802_11_AIROPEEK:
-               wth->phdr.pseudo_header.ieee_802_11.fcs_len = 0;                /* no FCS */
-               wth->phdr.pseudo_header.ieee_802_11.decrypted = FALSE;
-               break;
+       case WTAP_ENCAP_IEEE_802_11_WITH_RADIO:
+               memset(&phdr->pseudo_header.ieee_802_11, 0, sizeof(phdr->pseudo_header.ieee_802_11));
+               phdr->pseudo_header.ieee_802_11.fcs_len = 0;            /* no FCS */
+               phdr->pseudo_header.ieee_802_11.decrypted = FALSE;
+               phdr->pseudo_header.ieee_802_11.datapad = FALSE;
+               phdr->pseudo_header.ieee_802_11.phy = PHDR_802_11_PHY_UNKNOWN;
 
-       case WTAP_ENCAP_ETHERNET:
-               /* XXX - it appears that if the low-order bit of
-                  "status" is 0, there's an FCS in this frame,
-                  and if it's 1, there's 4 bytes of 0. */
-               wth->phdr.pseudo_header.eth.fcs_len = (status & 0x01) ? 0 : 4;
-               break;
-       }
+               /*
+                * Now process the radio information pseudo-header.
+                * It's a 4-byte pseudo-header, consisting of:
+                *
+                *   1 byte of data rate, in units of 500 kb/s;
+                *
+                *   1 byte of channel number;
+                *
+                *   1 byte of signal strength as a percentage of
+                *   the maximum, i.e. (RXVECTOR RSSI/RXVECTOR RSSI_Max)*100,
+                *   or, at least, that's what I infer it is, given what
+                *   the WildPackets note "Converting Signal Strength
+                *   Percentage to dBm Values" says (it also says that
+                *   the conversion the percentage to a dBm value is
+                *   an adapter-dependent process, so, as we don't know
+                *   what type of adapter was used to do the capture,
+                *   we can't do the conversion);
+                *
+                *   1 byte of unknown content (padding?).
+                */
+               if (phdr->len < RADIO_INFO_SIZE || phdr->caplen < RADIO_INFO_SIZE) {
+                       *err = WTAP_ERR_BAD_FILE;
+                       *err_info = g_strdup_printf("peekclassic: 802.11 packet has length < 4");
+                       return -1;
+               }
+               phdr->len -= RADIO_INFO_SIZE;
+               phdr->caplen -= RADIO_INFO_SIZE;
+               sliceLength -= RADIO_INFO_SIZE;
 
-       /* read the frame data */
-       buffer_assure_space(wth->frame_buffer, sliceLength);
-       wtap_file_read_expected_bytes(buffer_start_ptr(wth->frame_buffer),
-                                     sliceLength, wth->fh, err, err_info);
+               /* read the pseudo-header */
+               if (!wtap_read_bytes(fh, radio_info, RADIO_INFO_SIZE, err, err_info))
+                       return -1;
 
-       /* fill in packet header values */
-       tsecs = (time_t) (timestamp/1000000);
-       tusecs = (guint32) (timestamp - tsecs*1000000);
-       wth->phdr.ts.secs  = tsecs - mac2unix;
-       wth->phdr.ts.nsecs = tusecs * 1000;
+               phdr->pseudo_header.ieee_802_11.has_data_rate = TRUE;
+               phdr->pseudo_header.ieee_802_11.data_rate = radio_info[0];
+
+               phdr->pseudo_header.ieee_802_11.has_channel = TRUE;
+               phdr->pseudo_header.ieee_802_11.channel = radio_info[1];
+
+               phdr->pseudo_header.ieee_802_11.has_signal_percent = TRUE;
+               phdr->pseudo_header.ieee_802_11.signal_percent = radio_info[2];
 
-       if (wth->file_encap == WTAP_ENCAP_IEEE_802_11_AIROPEEK) {
                /*
                 * The last 4 bytes appear to be random data - the length
                 * might include the FCS - so we reduce the length by 4.
@@ -431,56 +509,65 @@ peekclassic_read_v7(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
                 * of junk at the end you get in Wireless Sniffer
                 * captures.
                 */
-                wth->phdr.len -= 4;
-                wth->phdr.caplen -= 4;
-       }
-
-       return TRUE;
-}
-
-static gboolean
-peekclassic_seek_read_v7(wtap *wth, gint64 seek_off,
-    struct wtap_pkthdr *phdr, guint8 *pd, int length,
-    int *err, gchar **err_info)
-{
-       union wtap_pseudo_header *pseudo_header = &phdr->pseudo_header;
-       guint8 ep_pkt[PEEKCLASSIC_V7_PKT_SIZE];
-       guint8  status;
-
-       if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
-               return FALSE;
-
-       /* Read the packet header. */
-       wtap_file_read_expected_bytes(ep_pkt, sizeof(ep_pkt), wth->random_fh,
-           err, err_info);
-       status = ep_pkt[PEEKCLASSIC_V7_STATUS_OFFSET];
-
-       switch (wth->file_encap) {
-
-       case WTAP_ENCAP_IEEE_802_11_AIROPEEK:
-               pseudo_header->ieee_802_11.fcs_len = 0;         /* no FCS */
-               pseudo_header->ieee_802_11.decrypted = FALSE;
+               if (phdr->len < 4 || phdr->caplen < 4) {
+                       *err = WTAP_ERR_BAD_FILE;
+                       *err_info = g_strdup_printf("peekclassic: 802.11 packet has length < 8");
+                       return -1;
+               }
+               phdr->len -= 4;
+               phdr->caplen -= 4;
                break;
 
        case WTAP_ENCAP_ETHERNET:
                /* XXX - it appears that if the low-order bit of
                   "status" is 0, there's an FCS in this frame,
                   and if it's 1, there's 4 bytes of 0. */
-               pseudo_header->eth.fcs_len = (status & 0x01) ? 0 : 4;
+               phdr->pseudo_header.eth.fcs_len = (status & 0x01) ? 0 : 4;
                break;
        }
 
+       /* read the packet data */
+       if (!wtap_read_packet_bytes(fh, buf, phdr->caplen, err, err_info))
+               return -1;
+
+       return sliceLength;
+}
+
+static gboolean peekclassic_read_v56(wtap *wth, int *err, gchar **err_info,
+    gint64 *data_offset)
+{
+       *data_offset = file_tell(wth->fh);
+
+       /* read the packet */
+       if (!peekclassic_read_packet_v56(wth, wth->fh, &wth->phdr,
+           wth->frame_buffer, err, err_info))
+               return FALSE;
+
        /*
-        * XXX - should "errno" be set in "wtap_file_read_expected_bytes()"?
+        * XXX - is the captured packet data padded to a multiple
+        * of 2 bytes?
         */
-       errno = WTAP_ERR_CANT_READ;
-       wtap_file_read_expected_bytes(pd, length, wth->random_fh, err,
-           err_info);
        return TRUE;
 }
 
-static gboolean
-peekclassic_read_v56(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
+static gboolean peekclassic_seek_read_v56(wtap *wth, gint64 seek_off,
+    struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info)
+{
+       if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
+               return FALSE;
+
+       /* read the packet */
+       if (!peekclassic_read_packet_v56(wth, wth->random_fh, phdr, buf,
+           err, err_info)) {
+               if (*err == 0)
+                       *err = WTAP_ERR_SHORT_READ;
+               return FALSE;
+       }
+       return TRUE;
+}
+
+static gboolean peekclassic_read_packet_v56(wtap *wth, FILE_T fh,
+    struct wtap_pkthdr *phdr, Buffer *buf, int *err, gchar **err_info)
 {
        peekclassic_t *peekclassic = (peekclassic_t *)wth->priv;
        guint8 ep_pkt[PEEKCLASSIC_V56_PKT_SIZE];
@@ -496,39 +583,31 @@ peekclassic_read_v56(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
        guint16 srcNum;
 #endif
        guint16 protoNum;
+#if 0
        char    protoStr[8];
+#endif
        unsigned int i;
 
-       /*
-        * XXX - in order to figure out whether this packet is an
-        * Ethernet packet or not, we have to look at the packet
-        * header, so we have to remember the address of the header,
-        * not the address of the data, for random access.
-        *
-        * If we can determine that from the file header, rather than
-        * the packet header, we can remember the offset of the data,
-        * and not have the seek_read routine read the header.
-        */
-       *data_offset = file_tell(wth->fh);
-
-       wtap_file_read_expected_bytes(ep_pkt, sizeof(ep_pkt), wth->fh, err,
-           err_info);
+       if (!wtap_read_bytes_or_eof(fh, ep_pkt, sizeof(ep_pkt), err, err_info))
+               return FALSE;
 
        /* Extract the fields from the packet */
-       length = pntohs(&ep_pkt[PEEKCLASSIC_V56_LENGTH_OFFSET]);
-       sliceLength = pntohs(&ep_pkt[PEEKCLASSIC_V56_SLICE_LENGTH_OFFSET]);
+       length = pntoh16(&ep_pkt[PEEKCLASSIC_V56_LENGTH_OFFSET]);
+       sliceLength = pntoh16(&ep_pkt[PEEKCLASSIC_V56_SLICE_LENGTH_OFFSET]);
 #if 0
        flags = ep_pkt[PEEKCLASSIC_V56_FLAGS_OFFSET];
        status = ep_pkt[PEEKCLASSIC_V56_STATUS_OFFSET];
 #endif
-       timestamp = pntohl(&ep_pkt[PEEKCLASSIC_V56_TIMESTAMP_OFFSET]);
+       timestamp = pntoh32(&ep_pkt[PEEKCLASSIC_V56_TIMESTAMP_OFFSET]);
 #if 0
-       destNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_DESTNUM_OFFSET]);
-       srcNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_SRCNUM_OFFSET]);
+       destNum = pntoh16(&ep_pkt[PEEKCLASSIC_V56_DESTNUM_OFFSET]);
+       srcNum = pntoh16(&ep_pkt[PEEKCLASSIC_V56_SRCNUM_OFFSET]);
 #endif
-       protoNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_PROTONUM_OFFSET]);
+       protoNum = pntoh16(&ep_pkt[PEEKCLASSIC_V56_PROTONUM_OFFSET]);
+#if 0
        memcpy(protoStr, &ep_pkt[PEEKCLASSIC_V56_PROTOSTR_OFFSET],
            sizeof protoStr);
+#endif
 
        /*
         * XXX - is the captured packet data padded to a multiple
@@ -539,75 +618,49 @@ peekclassic_read_v56(wtap *wth, int *err, gchar **err_info, gint64 *data_offset)
        if (0 == sliceLength) {
                sliceLength = length;
        }
-
-       /* read the frame data */
-       buffer_assure_space(wth->frame_buffer, sliceLength);
-       wtap_file_read_expected_bytes(buffer_start_ptr(wth->frame_buffer),
-                                     sliceLength, wth->fh, err, err_info);
+       /*
+        * The maximum value of sliceLength and length are 65535, which
+        * are less than WTAP_MAX_PACKET_SIZE will ever be, so we don't
+        * need to check them.
+        */
 
        /* fill in packet header values */
-       wth->phdr.len        = length;
-       wth->phdr.caplen     = sliceLength;
+       phdr->rec_type = REC_TYPE_PACKET;
+       phdr->presence_flags = WTAP_HAS_TS|WTAP_HAS_CAP_LEN;
        /* timestamp is in milliseconds since reference_time */
-       wth->phdr.ts.secs  = peekclassic->reference_time.tv_sec
-           + (timestamp / 1000);
-       wth->phdr.ts.nsecs = 1000 * (timestamp % 1000) * 1000;
-
-       wth->phdr.pkt_encap = WTAP_ENCAP_UNKNOWN;
-       for (i=0; i<NUM_PEEKCLASSIC_ENCAPS; i++) {
-               if (peekclassic_encap[i].protoNum == protoNum) {
-                       wth->phdr.pkt_encap = peekclassic_encap[i].encap;
-               }
-       }
-
-       switch (wth->phdr.pkt_encap) {
-
-       case WTAP_ENCAP_ETHERNET:
-               /* We assume there's no FCS in this frame. */
-               wth->phdr.pseudo_header.eth.fcs_len = 0;
-               break;
-       }
-       return TRUE;
-}
+       phdr->ts.secs  = peekclassic->reference_time + (timestamp / 1000);
+       phdr->ts.nsecs = 1000 * (timestamp % 1000) * 1000;
+       phdr->len      = length;
+       phdr->caplen   = sliceLength;
 
-static gboolean
-peekclassic_seek_read_v56(wtap *wth, gint64 seek_off,
-    struct wtap_pkthdr *phdr, guint8 *pd, int length,
-    int *err, gchar **err_info)
-{
-       union wtap_pseudo_header *pseudo_header = &phdr->pseudo_header;
-       guint8 ep_pkt[PEEKCLASSIC_V56_PKT_SIZE];
-       int pkt_encap;
-       guint16 protoNum;
-       unsigned int i;
-
-       if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
-               return FALSE;
-
-       wtap_file_read_expected_bytes(ep_pkt, sizeof(ep_pkt), wth->random_fh,
-           err, err_info);
-
-       protoNum = pntohs(&ep_pkt[PEEKCLASSIC_V56_PROTONUM_OFFSET]);
-       pkt_encap = WTAP_ENCAP_UNKNOWN;
+       phdr->pkt_encap = WTAP_ENCAP_UNKNOWN;
        for (i=0; i<NUM_PEEKCLASSIC_ENCAPS; i++) {
                if (peekclassic_encap[i].protoNum == protoNum) {
-                       pkt_encap = peekclassic_encap[i].encap;
+                       phdr->pkt_encap = peekclassic_encap[i].encap;
                }
        }
 
-       switch (pkt_encap) {
+       switch (phdr->pkt_encap) {
 
        case WTAP_ENCAP_ETHERNET:
                /* We assume there's no FCS in this frame. */
-               pseudo_header->eth.fcs_len = 0;
+               phdr->pseudo_header.eth.fcs_len = 0;
                break;
        }
 
-       /*
-        * XXX - should "errno" be set in "wtap_file_read_expected_bytes()"?
-        */
-       errno = WTAP_ERR_CANT_READ;
-       wtap_file_read_expected_bytes(pd, length, wth->random_fh, err,
-           err_info);
-       return TRUE;
+       /* read the packet data */
+       return wtap_read_packet_bytes(fh, buf, sliceLength, err, err_info);
 }
+
+/*
+ * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
+ *
+ * Local variables:
+ * c-basic-offset: 8
+ * tab-width: 8
+ * indent-tabs-mode: t
+ * End:
+ *
+ * vi: set shiftwidth=8 tabstop=8 noexpandtab:
+ * :indentSize=8:tabSize=8:noTabs=false:
+ */