[PATCH 1/2] wpcap: Implement pcap_dump_open and pcap_dump

[Sebastian Lackner]

On 11.02.2016 05:44, Jianqiu Zhang wrote:
> Hi, Slackner
> 
> Thanks for your so detailed reply and suggestions
> 
> I am working on error handling part of the code and I am a bit confused
> I looked up RtlAnsiStringToUnicodeString function , and found it would return
> 3 different ERROR STATUS,  given below: 
> --snip--
> 
>  * RETURNS
>  *  Success: STATUS_SUCCESS. uni contains the converted string
>  *  Failure: STATUS_BUFFER_OVERFLOW, if doalloc is FALSE and ansi is too small.
>  *           STATUS_NO_MEMORY, if doalloc is TRUE and the allocation fails.
>  *           STATUS_INVALID_PARAMETER_2, if the unicode string would be larger than 65535.
>  *
> 
> --snip--
> 
> For what error code will STATUS_INVALID_PARAMETER_2 Give , I can test by manually set the filename to a very long string, but I cannot test What ERROR code will be given
> when STATUS_NO_MEMORY returned in Windows, I try to allocate the memory until no more memory can be allocated with while(malloc(1)); but I get the same error code as STATUS_INVALID_PARAMETER_2 give

You do not have to create your own translation tables. Just translate the NTSTATUS into
an error code, similar to how its done in kernel32:

SetLastError(RtlNtStatusToDosError(status));

> 
> And what's more, I found something maybe interesting ,or strange
> 
> * On wine When the filename length is 65536 , the RtlAnsiStringToUnicodeString will pass successfully
>   and it will fail on RtlDosPathNameToNtPathName_U when the filename length is a bit shorter or equal 65535, it will fail on RtlAnsiStringToUnicodeString , why a longer string can pass the RtlAnsiStringToUnicodeString function, What I guess is overflow, but I haven't dig into it yet

That sounds like a separate issue. You can ignore such corner cases because the fix would
be unrelated to your implementation in wpcap.

> 
> * And another strange thing is On windows DumpFile_Test fail when the filename_length is longer than 218 chars(218 works well), On wine no errors happen until the filename length is longer than 255 (255 works well)

Such minor differences are known, but in this case there are no plans to be 100% "bug compatible" with Windows.

> 
> If no NTSTATUS ERRORCODE return and RtlDosPahNameToNtPathName_U return TRUE, I cannot set the errorcode , so when the filename length is between 218 to 255 , the pcap_dump_open will behave differently on win and wine, Should I use strlen to compare the string length of filename and set a errorcode when the filename length is longer than 218?

I don't think we really care about such minor differences, unless applications depend on it.
You can ignore them for now.

> 
> 
> 
> And By the way , I haven't correct my Memory leak problem, I will correct when send my patch :)
>