Bro segfaults with unknown linktype

Zeek
1

Hi,

we found a bug that segfaults bro. If you try to open a pcap file with a data link type that is unknown to libpcap (e.g. data link type 0x32), then it immediately crashes. The reason is in PktSrc.cc:

1.) In the constructor of PktFileSrc you first do an pcap_open_offline() and get a the pcap handle in pd.

2.) The you call SetHdrSize(), which calls Close() if no link type is found.

3.) Close closes pd, sets pd=0 and returns.

4.) back in PktFileSrc immediatly after SetHdrSize() you call pcap_file(pd) with the nulled pd, which leads to the Segfault in pcap.

I have added the relevant code fragments and a backtrace of gdb:

2

Thanks for tracking this down. I'll fix it.

Robin