From dd707937d5bf6dfc029d4bf87ada3bd5d5f2f936 Mon Sep 17 00:00:00 2001 From: Dominik Date: Fri, 20 Mar 2026 16:21:00 +0100 Subject: [PATCH] dump: check lseek() return in pcap record-counting loop MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When --dump-file points to an existing pcap file, dump_init_file() counts the existing records by reading each pcap record header and seeking past the payload. The lseek() return value was not checked: if it fails (e.g. EOVERFLOW on a 32-bit build with a very large incl_len, or any other seek error) the file position does not advance, the next read_write() call reads the same header again, and the loop spins forever — hanging daemon startup. Fix: break out of the loop on lseek failure. An undercount of existing records is harmless; a hanging startup is not. Signed-off-by: Dominik --- src/dump.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/dump.c b/src/dump.c index aa91458..5693c10 100644 --- a/src/dump.c +++ b/src/dump.c @@ -85,7 +85,8 @@ void dump_init(void) /* count existing records */ while (read_write(daemon->dumpfd, (void *)&pcap_header, sizeof(pcap_header), RW_READ)) { - lseek(daemon->dumpfd, pcap_header.incl_len, SEEK_CUR); + if (lseek(daemon->dumpfd, pcap_header.incl_len, SEEK_CUR) == (off_t)-1) + break; packet_count++; } }