From 2ddd26446e3a568074650cf16ec4ad8402acdcd4 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 12 Apr 2023 19:21:53 +0200 Subject: [PATCH] pcap: fix return check The check that meant to check if pcap_dispatch processed fewer packets than the desired number was inaccurate. It would also include all errors (negative return values). This patch considers only positive values for this check. Fixes: 9fe08f2374f6 ("pcap: improve pcap_breakloop support") --- src/source-pcap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/source-pcap.c b/src/source-pcap.c index afcc70c448..0bf5dab25b 100644 --- a/src/source-pcap.c +++ b/src/source-pcap.c @@ -323,7 +323,7 @@ static TmEcode ReceivePcapLoop(ThreadVars *tv, void *data, void *slot) int r = pcap_dispatch(ptv->pcap_handle, packet_q_len, (pcap_handler)PcapCallbackLoop, (u_char *)ptv); - if (unlikely(r == 0 || r == PCAP_ERROR_BREAK || r < packet_q_len)) { + if (unlikely(r == 0 || r == PCAP_ERROR_BREAK || (r > 0 && r < packet_q_len))) { if (r == PCAP_ERROR_BREAK && ptv->cb_result == TM_ECODE_FAILED) { SCReturnInt(TM_ECODE_FAILED); } -- 2.47.2