Skip to content

fix(corekit): end a cut list of schema items with the data, not in zero-filled items (#2756) - #2758

Merged
JarryShaw merged 1 commit into
mainfrom
fix/2756-igmpv3-framed-phantom-record
Nov 4, 2026
Merged

JarryShaw merged 1 commit into
mainfrom
fix/2756-igmpv3-framed-phantom-record

Conversation

@JarryShaw

Copy link
Copy Markdown
Owner

What is the purpose of your pull request?

  • fix — corrects a defect

Description of your pull request and other information

A list of schema items cut short of its declared length was zero-filled to that length (#2686), and items were then read on through the zeros. A framed IGMPv3 Report cut inside its records therefore listed records the capture never held, and a cut HTTP/2 SETTINGS frame listed 0:0 settings.

  • ListField stops before any item that would start past the captured octets. The item the cut lands inside still reads its missing octets as zeros, and the cut stays a quiet short read. The packet length < 0 warning from a trailing zero item is gone.
  • _zero_filled_items gives the zeros left unread back to the padding budget.
  • HTTPv2._make_http_settings pads a cut frame's settings with zeros to its declared Length, so parse → rebuild stays byte-exact.
  • Sweep of all six lists of schema items: only IGMPv3 records and HTTP/2 settings produced phantoms.
  • Both new test modules fail on base (106 and 43 failures) and pass with the fix. All plain-unittest legs pass.
  • Not changed: lists of plain values (e.g. GroupRecord.sources) still read uncaptured items as zeros.

Closes #2756

@JarryShaw JarryShaw added fix Pull requests that fix a defect (fix: subject prefix) review: running A cross-review is in flight against the current head - no verdict yet labels Nov 4, 2026
@github-actions github-actions Bot added this to the PyPCAPKit v1.6 milestone Nov 4, 2026
@JarryShaw JarryShaw moved this to In review in PyPCAPKit Nov 4, 2026
@JarryShaw

Copy link
Copy Markdown
Owner Author

NEEDS CHANGES at 71f5a46d7 (Sonnet cross-review, reproduced locally)

  • Regression: an edited cut SETTINGS frame no longer recomputes its Length. Take a frame cut at 10 octets, set settings to one pair in its to_dict(), and call HTTPv2.from_data. Base gives Length 6 (15 octets); this head pads back to Length 18. The __short_read__ gate in _make_http_settings pads any list, so it should pad only when the settings are still the pairs the captured octets begin.
  • Held up: every boundary cut (no zero-only item, the item the cut lands inside kept); the ledger give-back and the raise path; byte-exact rebuild of unedited cuts; no regression across the six schema-item lists; the adapted tests; the tier markers; the docs.
  • CI on this head is cancelled until the fix round lands.

@JarryShaw JarryShaw added review: needs-changes Cross-review at the current head says changes are required; see the verdict comment and removed review: running A cross-review is in flight against the current head - no verdict yet labels Nov 4, 2026
…ro-filled items (#2756)

A list of schema items whose length runs past the data zero-fills its octets
to that length (#2686) and read items on through the zeros, so a framed
IGMPv3 Report cut inside its records listed a record the capture never held,
and a cut HTTP/2 SETTINGS frame listed settings of identifier and value zero.

* ListField: no item is read past the octets present; the item the data ends
  inside still reads its missing octets as zeros, and the cut stays the
  schema's short read, quietly.
* _zero_filled_items: yield a stream and give back to the padding ledger the
  zeros the items leave unread, so they are not counted as octets read.
* HTTPv2: a SETTINGS frame cut inside its settings, and unedited, rebuilds its
  settings with zeros after them to the Length it declares, so the rebuild is
  byte-exact; an edited one computes its Length as a whole frame does.
* Tests: a framed IGMPv3 sweep and a sweep over every list of schema items;
  the #2659, #2686 and IGMP cut tests no longer expect the zero-filled items.
@JarryShaw JarryShaw removed the review: needs-changes Cross-review at the current head says changes are required; see the verdict comment label Nov 4, 2026
@JarryShaw
JarryShaw force-pushed the fix/2756-igmpv3-framed-phantom-record branch from 71f5a46 to 5b967c7 Compare November 4, 2026 06:17
@JarryShaw JarryShaw added the review: running A cross-review is in flight against the current head - no verdict yet label Nov 4, 2026
@JarryShaw

Copy link
Copy Markdown
Owner Author

GOOD TO GO at 5b967c748 (Sonnet re-review, and my own probe)

  • Round-1 regression fixed. An edited cut SETTINGS frame recomputes its Length again. At cuts 10, 12 and 17, one pair gives 6 and none gives 0. Changing values or reversing the pairs also recomputes it. Unedited cuts 0–17 still rebuild byte-exact at 18, from both info and to_dict().
  • How the padding is decided. It happens only when the settings still pack to the captured packet[:keep], which is always the settings payload. A cut in the frame header (type/stream) counts as no settings captured.
  • Known limit. An "edit" that leaves the settings byte-identical to the capture keeps the declared Length. It can't be told apart from no edit.
  • Tests. The new EditedFrameTests fails on 71f5a46d7 and passes here. The 2756, 2686, 2749 and IGMP modules pass, along with the short-read and schema round trips. Project tests, Lint and deploy-pages pass.

@JarryShaw JarryShaw added review: good-to-go Cross-review at the current head says ready; CI state is separate and removed review: running A cross-review is in flight against the current head - no verdict yet labels Nov 4, 2026
@github-actions

github-actions Bot commented Nov 4, 2026

Copy link
Copy Markdown
Contributor

Coverage: 94.45% (unit tier, Python 3.15, 5b967c748, Unit Tests run success)

Package Statements Missed Branches Partial Cover
pcapkit (top level) 104 4 20 2 95.16%
pcapkit/const 20918 175 2908 156 98.57%
pcapkit/corekit 2895 76 930 37 96.84%
pcapkit/dumpkit 286 3 102 3 98.45%
pcapkit/foundation 3505 27 1216 32 98.75%
pcapkit/interface 138 4 52 3 96.32%
pcapkit/protocols 22792 155 5910 127 99.00%
pcapkit/toolkit 961 26 342 8 96.62%
pcapkit/utilities 559 7 150 5 98.31%
pcapkit/vendor 5590 2286 1280 214 55.75%

Per-file detail: the coverage-html artifact of this run.

@JarryShaw
JarryShaw merged commit b776687 into main Nov 4, 2026
67 checks passed
@github-project-automation github-project-automation Bot moved this from In review to Done in PyPCAPKit Nov 4, 2026
@JarryShaw
JarryShaw deleted the fix/2756-igmpv3-framed-phantom-record branch November 4, 2026 13:52
@JarryShaw JarryShaw removed the review: good-to-go Cross-review at the current head says ready; CI state is separate label Nov 4, 2026
JarryShaw added a commit that referenced this pull request Nov 4, 2026
- Fixed: a cut header's rebuild keeps the next layer its parse had, where
  1.5.x rebuilt a cut Ethernet header's Raw as NoPayload, and that Raw
  carries no error (#2759), a new entry; old values measured against v1.5.1.
- Amended unreleased entries (#2758): a cut list of schema items ends with
  the data, the item the cut lands inside zero-filled and none past it, in
  the ListField, IGMP and HTTP/2 SETTINGS entries, the last also rebuilding at
  its declared Length or a recomputed one once edited.
- Folded (#2755): a counted item the data ends inside reads as a quiet short
  read, into the ListField and IGMP entries.
- CHANGELOG.md regenerated; util/changelog_md.py --check passes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

fix Pull requests that fix a defect (fix: subject prefix)

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

fix(internet): a framed IGMPv3 Report cut inside a record parses a phantom zero-filled record

1 participant