diff --git a/src/capture_pcap.rs b/src/capture_pcap.rs index 2f9b1d2..3b169eb 100644 --- a/src/capture_pcap.rs +++ b/src/capture_pcap.rs @@ -142,7 +142,7 @@ where // 1) all bytes have been read // 2) no more data is available if self.buffer.available_data() == 0 - && (self.buffer.position() == 0 || self.reader_exhausted) + && (self.buffer.position() == 0 && self.reader_exhausted) { return Err(PcapError::Eof); } diff --git a/src/capture_pcapng.rs b/src/capture_pcapng.rs index 1b34b64..18cf166 100644 --- a/src/capture_pcapng.rs +++ b/src/capture_pcapng.rs @@ -154,7 +154,7 @@ where // 1) all bytes have been read // 2) no more data is available if self.buffer.available_data() == 0 - && (self.buffer.position() == 0 || self.reader_exhausted) + && (self.buffer.position() == 0 && self.reader_exhausted) { return Err(PcapError::Eof); } diff --git a/tests/pcapng.rs b/tests/pcapng.rs index 34ccbc8..18fd5f8 100644 --- a/tests/pcapng.rs +++ b/tests/pcapng.rs @@ -431,3 +431,24 @@ fn test_reader_buffer_too_small() { } assert_eq!(num_blocks, 9); } + +// related issue: https://github.com/rusticata/pcap-parser/issues/30 +#[test] +fn test_pcapng_earlyeofandnotexhausted() { + let path = "assets/test001-le.pcapng"; + let file = File::open(path).unwrap(); + let buffered = BufReader::new(file); + + // 96 is exactly the size of the first SHB, so the first consume will empty the buffer + let mut reader = PcapNGReader::new(96, buffered).expect("PcapNGReader"); + let (offset, _block) = reader.next().expect("could not read first block"); + reader.consume(offset); + // the second read happens in the following situation: buf.available_data == 0 AND buf.position == 0 + assert_eq!(reader.position(), 0); + assert!(reader.data().is_empty()); + let res = reader.next(); + // res should not be Eof + assert!(!matches!(res, Err(PcapError::Eof))); + // res should be Incomplete(4) (attempt to read magic) + assert!(matches!(res, Err(PcapError::Incomplete(4)))); +}