Skip to content

Handle malformed gzip pcaps #5162

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gpotter2 merged 1 commit into from
Sep 11, 2026
+29 −4
Merged

Handle malformed gzip pcaps #5162

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions scapy/utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@
import time
import traceback
import warnings
import zlib

from scapy.config import conf
from scapy.consts import DARWIN, OPENBSD, WINDOWS
Expand Down Expand Up @@ -1387,7 +1388,7 @@ def open(fname # type: Union[IO[bytes], str]
fdesc = open(filename, "rb") # type: _ByteStream
magic = fdesc.peek(2)[:2] # type: ignore[union-attr] # BufferedReader
if magic != b"\x1f\x8b":
magic = fdesc.read(2)
magic = fdesc.read(4)
else:
fdesc = fname
filename = getattr(fdesc, "name", "No name")
Expand All @@ -1396,9 +1397,19 @@ def open(fname # type: Union[IO[bytes], str]
# GZIP header detected.
if not isinstance(fname, str):
fdesc.seek(0)
fdesc = gzip.GzipFile(fileobj=fdesc)
magic = fdesc.read(2)
magic += fdesc.read(2)
raw_fdesc = fdesc
fdesc = gzip.GzipFile(fileobj=raw_fdesc)
try:
magic = fdesc.read(4)
except (EOFError, OSError, zlib.error) as err:
fdesc.close()
if isinstance(fname, str):
raw_fdesc.close()
raise Scapy_Exception(
"Not a supported capture file (invalid gzip file)"
) from err
else:
magic += fdesc.read(4 - len(magic))
return filename, fdesc, magic


Expand Down
14 changes: 14 additions & 0 deletions test/regression.uts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2480,6 +2480,20 @@ except Scapy_Exception:
file = BytesIO(b"\n\r\r\n\x00\x00\x008\x1a+<M\x00\x01\x00\x00\xef\xff\xff\x81\x01\x00\x00\x01\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x009\x00\x00\x00\x01\x00\x00\x000\x00e\x00\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x06\x00\x00\x00d\x00\x00\x00\x00'\x00\x00\x00\x01\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x80\x01\x00\x00\x000\x00\x00\x00\x01\x00\x00\x008\x00\x00\n\x0c\x00A\x05\xc0\x01\x00\x00\x00\x00\x00d\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x01\x00\x00\x008\x00\x00\n\x0c\x00A\x05\xc0\x83\x00\x00\x043\x01\x00\x00\x00\x00\x00d\x00\x00\x00\x00d")
l = rdpcap(file)

# Malformed gzip header with unknown method
import os, tempfile
fdesc, filename = tempfile.mkstemp()
try:
with os.fdopen(fdesc, "wb") as f:
_ = f.write(b"\x1f\x8b\x20\xa1")
try:
rdpcap(filename)
assert False
except Scapy_Exception:
pass
finally:
os.unlink(filename)

# Issue #69628
file = BytesIO(b"\xd4\xc3\xb2\xa1\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\x00\x00\x01\x00\x00\x00\x04{\xdcf\xc2\xa5\x07\x008\x00\x00\x008\x00\x00\x00A]+\xdb]\x04\x8e(6\n\x99\xcb\x08\x00E\x00\x00*\x00\x01\x00\x00@\x06\xe3V\x07\x87\xa5m\x17\x15\xd3m\x01\x85\x01\x85\x00\x00\x00\x00\x00\x00\x00\x00P\x02 \x00\xc5_\x00\x000\x00")
l = rdpcap(file)
Expand Down
Loading