Skip to content

fix(internet): a standalone IGMPv3 Report cut inside a record warns 'packet length < 0', repeatedly #2749

Closed

Description

@JarryShaw

Describe the bug
Parse a standalone IGMPv3 Report whose capture is cut inside a group record. It emits SchemaWarning: packet length < 0, between one and five times for the same cut. Under the short-read convention, a cut is recorded on the layer as a short read and stays quiet. #1140 and #1148 fixed the same warning for other list items.

Reproduction
The #2738 round-5 review hit this on 2ade9f4b3: IGMPv3(data) on a Report with its last record cut mid-way. main (dea098b15) behaves the same, so #2738 does not cause it. Frames parsed through IPv4 are not affected.

Expected behavior
The cut reads TRUNCATED with its short-read record and emits no warning. The rebuild stays byte-exact.

Additional context
This is blocked until #2738 merges: that PR rewrites how a Report's record list is read (ListField count and shortfall), and the fix belongs on top of it. The warning comes from Schema.unpack's negative-length check.

Activity

  1. added
    bugIssues reporting a defect (set by the bug report template; a default, not an assessment)
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Nov 3, 2026
  2. added this to the PyPCAPKit v1.6 milestone on Nov 3, 2026
  3. moved this to Blocked in PyPCAPKiton Nov 3, 2026
  4. JarryShaw commented on Nov 3, 2026

    @JarryShaw
    OwnerAuthor

    #2738 has merged, so the earlier hold has cleared. This now waits on the #2534 regrouping, which is running in the serial window and moves every protocol module. It is dispatched as soon as that lands.

  5. JarryShaw commented on Nov 4, 2026

    @JarryShaw
    OwnerAuthor

    #2534 has landed (#2753), so this is unblocked. A fix is in progress on a branch off 1b4f9703e, in the shared Schema/field path rather than an IGMPv3-only suppression. It includes a sweep of other count-sized lists.

  6. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Nov 4, 2026
  7. moved this from Blocked to WIP in PyPCAPKiton Nov 4, 2026
  8. JarryShaw commented on Nov 4, 2026

    @JarryShaw
    OwnerAuthor

    The PR is #2755.

  9. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Nov 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugIssues reporting a defect (set by the bug report template; a default, not an assessment)

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions