[Eapp1e]

scapy/contrib/tcpros.py parses its field lists by re-slicing the remaining buffer on every field (guess_payload_class, TCPROSHeader.pre_dissect, TCPROSBody.pre_dissect), so every field copies the rest of the buffer.

This reads the field lengths in place with struct.unpack_from() through a shared tcpros_iter_field_lengths() helper. The parsing result is unchanged; on a header of 8000 fields, TCPROS.guess_payload_class() goes from 32.7 ms to 1.8 ms.

Closes #5244

This message was written with the help of AI.

[codecov]

Codecov Report

❌ Patch coverage is 86.66667% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.45%. Comparing base (770ab0f) to head (1f4b436).

Files with missing lines	Patch %	Lines
scapy/contrib/tcpros.py	86.66%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #5252      +/-   ##
==========================================
+ Coverage   80.41%   80.45%   +0.03%     
==========================================
  Files         376      376              
  Lines       98405    98401       -4     
==========================================
+ Hits        79137    79167      +30     
+ Misses      19268    19234      -34     

Files with missing lines	Coverage Δ
scapy/contrib/tcpros.py	76.42% <86.66%> (+21.56%)	⬆️

... and 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Eapp1e]

The Codecov comment above predates the current head (0772fb73). Those two uncovered lines were the conf.debug_dissector prints in TCPROSHeader.pre_dissect, and they are now exercised by the two new cases in test/contrib/tcpros.uts (a header/body pair with debug_dissector forced on, restored in a finally):

$ python -m scapy.tools.UTscapy -t test/contrib/tcpros.uts -f text
UTscapy ended successfully

So the patch should be fully covered on re-run; the stale 86.67% is from the previous commit (1f4b436).

[Eapp1e]

Pinging for review now that the checks are green. The change is contained to TCPROSHeader/TCPROSBody field parsing: the old loop re-sliced the remaining payload for every field, so parsing time grew quadratically with nfields (a 8000-field header took 32.7 ms, now 1.8 ms, identical output).

Happy to adjust the approach — e.g. keep the helper private to the module or inline it — if you would rather have it a different way.