[bIackr0se]

Description

A PROFINET alarm frame shorter than the Ethernet minimum is padded to 60 bytes, and scapy dissects the pad bytes as alarm content. Alarm_Low and Alarm_High read RTA_SDU from all remaining bytes instead of VarPartLen bytes, and AlarmPayload reads alarm items up to the end of the data instead of block_length. A pull alarm gets an extra AlarmItem, and an RTA acknowledgement (VarPartLen=0) is dissected as an alarm notification. When building, VarPartLen stays 0.

The fix bounds RTA_SDU by VarPartLen and AlarmPayload by block_length, returns the bytes after the RTA-SDU as padding, and computes VarPartLen when it is left unset.

from scapy.all import Ether
from scapy.contrib.pnio import ProfinetIO
p = Ether(bytes.fromhex(  # pull alarm, padded to 60 bytes
    "00112233445500665566aabb8892fe01000300031100"
    "0000ffff001a0002001601000003000000000001000100"
    "000032000000010800000000000000"))
print(p[ProfinetIO].payload.RTA_SDU.AlarmPayload)

Before:

[<AlarmItem  UserStructureIdentifier=0x0 load=<Raw  load=b'\x00\x00\x00\x00' |> |>]

After:

[]

tshark dissects the same frames as the patched scapy: no item in the pull alarm, one item in a padded RS alarm, and no notification in the acknowledgement.

A capture built by earlier scapy versions has VarPartLen=0, so its notification now dissects as padding.

This message was written with the help of AI (Claude Opus 5.5).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.55%. Comparing base (78a2def) to head (e6dbeb1).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #5254   +/-   ##
=======================================
  Coverage   80.54%   80.55%           
=======================================
  Files         375      375           
  Lines       98399    98403    +4     
=======================================
+ Hits        79255    79265   +10     
+ Misses      19144    19138    -6     

Files with missing lines	Coverage Δ
scapy/contrib/pnio_rpc.py	94.72% <100.00%> (+0.05%)	⬆️

... and 8 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.