We can't check the length of an SHB until we determine the byte order.
authorGuy Harris <guy@alum.mit.edu>
Tue, 14 Oct 2014 23:53:03 +0000 (16:53 -0700)
committerGuy Harris <guy@alum.mit.edu>
Tue, 14 Oct 2014 23:53:48 +0000 (23:53 +0000)
commit0ac944944233b49c77a77da65be19ce4c2e65647
tree781b39df5ebefb4ce4ae37f43f4e897becd20de4
parent44204614e8c177f84acf39b976f272d86ef03c6a
We can't check the length of an SHB until we determine the byte order.

Don't check a possibly-byte-swapped length against the minimum SHB size;
it'll probably look huge if it's byte-swapped, so the test won't fail
even if it is too small, and a really huge SHB's length could look too
small if it's byte-swapped.

Do the check *after* we've read the fixed-length portion of the block;
yes, that means we've read past the purported size of the block at that
point, but if that read succeeds, that doesn't matter, and if that read
fails, it just means we'll report "file cut short" rather than "bad SHB
length", *both* of which are problems with the file.

Change-Id: Ie3b5700662f2a6da40d373a84f00a8fc2cf0ce1b
Reviewed-on: https://code.wireshark.org/review/4692
Reviewed-by: Guy Harris <guy@alum.mit.edu>
wiretap/pcapng.c