[PATCH v6 1/5] pcapng: add length checks to string arguments

Stephen Hemminger
2026-01-26T21:06:32Z

The pcapng file format uses a 16-bit length field in the option
TLV (Type-Length-Value) encoding, limiting strings to UINT16_MAX
bytes.

Add validation for string arguments to prevent silent truncation
or buffer issues when callers pass excessively long strings.
Also update the Doxygen comments for rte_pcapng_add_interface()
and rte_pcapng_write_stats() to document return values.

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
doc/guides/rel_notes/release_26_03.rst | 3 ++
lib/pcapng/rte_pcapng.c | 39 ++++++++++++++++++++++----
lib/pcapng/rte_pcapng.h | 6 +++-
3 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/doc/guides/rel_notes/release_26_03.rst b/doc/guides/rel_notes/release_26_03.rst
index 15dabee7a1..0909be140e 100644
--- a/doc/guides/rel_notes/release_26_03.rst
+++ b/doc/guides/rel_notes/release_26_03.rst
@@ -84,6 +84,9 @@ API Changes
Also, make sure to start the actual text at the margin.
=======================================================

+* pcapng: The maximum length of option strings is now validated.
+ The pcapng file format only allows up to 65536 characters.
+

ABI Changes
-----------
diff --git a/lib/pcapng/rte_pcapng.c b/lib/pcapng/rte_pcapng.c
index 2cc9e2040d..61d37b4462 100644
--- a/lib/pcapng/rte_pcapng.c
+++ b/lib/pcapng/rte_pcapng.c
@@ -34,6 +34,9 @@
/* conversion from DPDK speed to PCAPNG */
#define PCAPNG_MBPS_SPEED 1000000ull

+/* upper bound for strings in pcapng option data */
+#define PCAPNG_STR_MAX UINT16_MAX
+
/* upper bound for section, stats and interface blocks (in uint32_t) */
#define PCAPNG_BLKSIZ (2048 / sizeof(uint32_t))

@@ -218,9 +221,11 @@ rte_pcapng_add_interface(rte_pcapng_t *self, uint16_t port, uint16_t link_type,
char ifname_buf[IF_NAMESIZE];
char ifhw[256];
uint64_t speed = 0;
+ int ret;

- if (rte_eth_dev_info_get(port, &dev_info) < 0)
- return -1;
+ ret = rte_eth_dev_info_get(port, &dev_info);
+ if (ret < 0)
+ return ret;

/* make something like an interface name */
if (ifname == NULL) {
@@ -230,8 +235,14 @@ rte_pcapng_add_interface(rte_pcapng_t *self, uint16_t port, uint16_t link_type,
snprintf(ifname_buf, IF_NAMESIZE, "dpdk:%u", port);
ifname = ifname_buf;
}
+ } else if (strlen(ifname) > PCAPNG_STR_MAX) {
+ return -EINVAL;
}

+ if ((ifdescr && strlen(ifdescr) > PCAPNG_STR_MAX) ||
+ (filter && strlen(filter) > PCAPNG_STR_MAX))
+ return -EINVAL;
+
/* make a useful device hardware string */
dev = dev_info.device;
if (dev)
@@ -269,7 +280,7 @@ rte_pcapng_add_interface(rte_pcapng_t *self, uint16_t port, uint16_t link_type,
len += sizeof(uint32_t);

if (len > sizeof(buf))
- return -1;
+ return -EINVAL;

hdr = (struct pcapng_interface_block *)buf;
*hdr = (struct pcapng_interface_block) {
@@ -334,7 +345,10 @@ rte_pcapng_write_stats(rte_pcapng_t *self, uint16_t port_id,
uint32_t optlen, len;
uint32_t buf[PCAPNG_BLKSIZ];

- RTE_ETH_VALID_PORTID_OR_ERR_RET(port_id, -EINVAL);
+ RTE_ETH_VALID_PORTID_OR_ERR_RET(port_id, -ENODEV);
+
+ if (comment && strlen(comment) > PCAPNG_STR_MAX)
+ return -EINVAL;

optlen = 0;

@@ -487,7 +501,14 @@ rte_pcapng_copy(uint16_t port_id, uint32_t queue,
bool rss_hash;

#ifdef RTE_LIBRTE_ETHDEV_DEBUG
+ /*
+ * Since this function is used in the fast path for packet capture
+ * skip argument validation checks unless debug is enabled.
+ */
RTE_ETH_VALID_PORTID_OR_ERR_RET(port_id, NULL);
+
+ if (comment && strlen(comment) > PCAPNG_STR_MAX)
+ return NULL;
#endif
orig_len = rte_pktmbuf_pkt_len(md);

@@ -692,8 +713,16 @@ rte_pcapng_fdopen(int fd,
struct timespec ts;
uint64_t cycles;

+ if ((osname && strlen(osname) > PCAPNG_STR_MAX) ||
+ (hardware && strlen(hardware) > PCAPNG_STR_MAX) ||
+ (appname && strlen(appname) > PCAPNG_STR_MAX) ||
+ (comment && strlen(comment) > PCAPNG_STR_MAX)) {
+ rte_errno = ENAMETOOLONG;
+ return NULL;
+ }
+
self = malloc(sizeof(*self));
- if (!self) {
+ if (self == NULL) {
rte_errno = ENOMEM;
return NULL;
}
diff --git a/lib/pcapng/rte_pcapng.h b/lib/pcapng/rte_pcapng.h
index de1bf953e9..d866042b66 100644
--- a/lib/pcapng/rte_pcapng.h
+++ b/lib/pcapng/rte_pcapng.h
@@ -89,6 +89,10 @@ rte_pcapng_close(rte_pcapng_t *self);
* Interfaces must be added to the output file after opening
* and before any packet record. All ports used in packet capture
* must be added.
+ *
+ * @return
+ * - returns number of bytes written on success,
+ * or negative errno on failure.
*/
int
rte_pcapng_add_interface(rte_pcapng_t *self, uint16_t port, uint16_t link_type,
@@ -192,7 +196,7 @@ rte_pcapng_write_packets(rte_pcapng_t *self,
* @param comment
* Optional comment to add to statistics.
* @return
- * number of bytes written to file, -1 on failure to write file
+ * number of bytes written to file, -1 on failure to write file or memory allocation failure.
*/
ssize_t
rte_pcapng_write_stats(rte_pcapng_t *self, uint16_t port,
--
2.51.0