Bro segfaults with unknown linktype


we found a bug that segfaults bro. If you try to open a pcap file with a data link type that is unknown to libpcap (e.g. data link type 0x32), then it immediately crashes. The reason is in

1.) In the constructor of PktFileSrc you first do an pcap_open_offline() and get a the pcap handle in pd.

2.) The you call SetHdrSize(), which calls Close() if no link type is found.

3.) Close closes pd, sets pd=0 and returns.

4.) back in PktFileSrc immediatly after SetHdrSize() you call pcap_file(pd) with the nulled pd, which leads to the Segfault in pcap.

I have added the relevant code fragments and a backtrace of gdb:

Thanks for tracking this down. I'll fix it.