Fix block-skip length logic for pcapng

tfarley · Apr 30, 2017 · 33e7799 · 33e7799
1 parent 123192c
commit 33e7799
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/aclogview/PCapReader.cs b/aclogview/PCapReader.cs
@@ -153,8 +153,9 @@ private static List<PacketRecord> loadPcapPacketRecords(BinaryReader binaryReade
                             break;
 
                         results.Add(packetRecord);
-                        curPacket++;
                     }
+
+                    curPacket++;
                 }
                 catch (Exception e)
                 {
@@ -172,6 +173,8 @@ private static PcapngBlockHeader readPcapngBlockHeader(BinaryReader binaryReader
                 throw new InvalidDataException("Stream cut short (packet " + curPacket + "), stopping read: " + (binaryReader.BaseStream.Length - binaryReader.BaseStream.Position));
             }
 
+            long blockStartPos = binaryReader.BaseStream.Position;
+
             PcapngBlockHeader blockHeader = PcapngBlockHeader.read(binaryReader);
 
             if (blockHeader.capturedLen > 50000)
@@ -182,7 +185,7 @@ private static PcapngBlockHeader readPcapngBlockHeader(BinaryReader binaryReader
             // Make sure there's enough room for an ethernet header
             if (blockHeader.capturedLen < 14)
             {
-                binaryReader.BaseStream.Position += blockHeader.capturedLen;
+                binaryReader.BaseStream.Position += blockHeader.blockTotalLength - (binaryReader.BaseStream.Position - blockStartPos);
                 return null;
             }
 
@@ -236,8 +239,9 @@ private static List<PacketRecord> loadPcapngPacketRecords(BinaryReader binaryRea
                             break;
 
                         results.Add(packetRecord);
-                        curPacket++;
                     }
+
+                    curPacket++;
                 }
                 catch (Exception e)
                 {