Skip to content

fix(internet): a truncated IGMPv3 Report falls back to Raw instead of parsing what it carries #2650

Closed

Description

@JarryShaw

While #2618 was being written, an IGMPv3 Membership Report cut short by the capture fell back to Raw with the error "Field records has an item that consumed no data". It did not parse as IGMPv3 with a truncated record list, so no checksum_status is recorded for it. An IGMPv3 Query cut the same way parses. This is older behaviour, not something #2618 introduced. The worker observed it, and it has not yet been reproduced independently.

Expected: a Report whose record list is cut short parses as far as its octets go and is marked truncated, as other list-bearing schemas are. It should not refuse the whole layer.

To do: reproduce on main, find where the record-list field refuses a zero-length item, and fix that at the source. Cover a Report cut inside a record header and a Report cut inside a source list.

Activity

  1. added this to the PyPCAPKit v1.6 milestone on Nov 2, 2026
  2. added
    bugIssues reporting a defect (set by the bug report template; a default, not an assessment)
    pendingAccepted and unstarted - nobody is on it and nothing blocks it
    on Nov 2, 2026
  3. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    pendingAccepted and unstarted - nobody is on it and nothing blocks it
    on Nov 2, 2026
  4. JarryShaw commented on Nov 2, 2026

    @JarryShaw
    OwnerAuthor

    The PR is #2662.

  5. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Nov 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugIssues reporting a defect (set by the bug report template; a default, not an assessment)

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions