From Stephen Donnelly:

ERF files can contain records of type TYPE_PAD. These records are not related
to captured packets, have a zero timestamp value and no associated packet data.
Normally TYPE_PAD records are stripped out during capture, but in rare cases
unstripped files may exist.
Previously wiretap/erf.c generated an 'unknown record encapsulation' error when
encountering TYPE_PAD records.
With this patch Wireshark skips over any TYPE_PAD records within ERF traces
files without reporting an error. TYPE_PAD records are not counted, displayed
or decoded.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@25733 f5534014-38df-0310-8fa8-9805f1628bb7

diff --git a/wiretap/erf.c b/wiretap/erf.c
index 5b2902064ce20760f1d3209698febb40fe81429f..27910ca02581d42098678fc82d151db6039609f6 100644 (file)
--- a/wiretap/erf.c
+++ b/wiretap/erf.c
@@ -277,9 +277,11 @@ static gboolean erf_seek_read(wtap *wth, gint64 seek_off,
   if (file_seek(wth->random_fh, seek_off, SEEK_SET, err) == -1)
     return FALSE;
 
-  if (!erf_read_header(wth->random_fh, NULL, pseudo_header, &erf_header,
-                      err, err_info, NULL, &packet_size))
-    return FALSE;
+  do {
+    if (!erf_read_header(wth->random_fh, NULL, pseudo_header, &erf_header,
+                        err, err_info, NULL, &packet_size))
+      return FALSE;
+  } while ( erf_header.type == ERF_TYPE_PAD );
 
   wtap_file_read_expected_bytes(pd, (int)packet_size, wth->random_fh, err);
 
@@ -348,6 +350,7 @@ static int erf_read_header(FILE_T fh,
     return TRUE;
     ***/
     break;
+  case ERF_TYPE_PAD:
   case ERF_TYPE_HDLC_POS:
   case ERF_TYPE_COLOR_HDLC_POS:
   case ERF_TYPE_DSM_COLOR_HDLC_POS: