[Winpcap-users] PacketGetNetInfoEx() and multiple addresses

Matias Ernesto Eissler matias.eissler at coresecurity.com
Wed Oct 18 16:27:28 GMT 2006


Hi all,

   I've been looking the sources of PacketGetNetInfoEx() on v3.1 sources 
[packet32.c:2149] and there's something I don't understand:

   According to the documentation on 
http://www.winpcap.org/docs/man/html/group__packet32.html#a27 
PacketGetNetInfoEx() expects, as its third parameter (NEntries), the 
size of its second parameter (buffer) and goes further to say that if 
one only wants the first address then sizeof(npf_if_addr) should be 
passed. However the code seems to compare NEntries with 
TAdInfo->NNetworkAddresses, which I think is the number of network 
addresses this interface has. Then it assigns the smaller of them back 
to NEntries which is then multiplied by sizeof(npf_if_addr) and used as 
the number of bytes for memcpy to copy back to the user buffer:

        *NEntries = (TAdInfo->NNetworkAddresses < *NEntries)? 
TAdInfo->NNetworkAddresses: *NEntries;
        //TODO what if nentries = 0?
        if (*NEntries > 0)
            memcpy(buffer, TAdInfo->NetworkAddresses, *NEntries * 
sizeof(npf_if_addr));

   What I don´t understand is this: lets say the interface has 2 network 
addresses and I only want the first one, so I would call 
PacketGetNetInfoEx(ifName, myBuffer, sizeof(npf_if_addr)), but then 
TAdInfo->NNetworkAddresses would be 2 since that is the number of 
addresses the interface had, then 2 would be smaller than NEntries = 
sizeof(npf_if_addr), then NEntries would be assigned 2 and then 2 
sizeof(npf_if_addr) bytes would be copied to myBuffer which was only 
sizeof(npf_if_addr) length.

   What am I missing? is this scenario at all possible?

   Thanks in advanced,

      Matias.




More information about the Winpcap-users mailing list