Boost the maximum packet size for LINKTYPE_USBPCAP in pcap/pcapng.

Bug: 15985
Change-Id: I8e043431bbf874d640d4407335d525a44815ee73
Reviewed-on: https://code.wireshark.org/review/34327
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>

3 files changed, 49 insertions, 34 deletions

diff --git a/dumpcap.c b/dumpcap.c
index 5daee8bf89..31a6ab8b05 100644
--- a/dumpcap.c
+++ b/dumpcap.c
@@ -1944,24 +1944,24 @@ pcap_pipe_open_live(int fd,
         hdr->network = GUINT32_SWAP_LE_BE(hdr->network);
     }
     pcap_src->linktype = hdr->network;
-#ifdef DLT_DBUS
-    if (pcap_src->linktype == DLT_DBUS) {
-        /*
-         * The maximum D-Bus message size is 128MB, so allow packets up
-         * to that size.
-         */
+    /* Pick the appropriate maximum packet size for the link type */
+    switch (pcap_src->linktype) {
+
+    case 231: /* DLT_DBUS */
         pcap_src->cap_pipe_max_pkt_size = WTAP_MAX_PACKET_SIZE_DBUS;
-    } else
-#endif
-    if (pcap_src->linktype == 279) {             /* DLT_EBHSCR */
-        /*
-         * The maximum EBHSCR message size is 8MB, so allow packets up
-         * to that size.
-         */
+        break;
+
+    case 279: /* DLT_EBHSCR */
         pcap_src->cap_pipe_max_pkt_size = WTAP_MAX_PACKET_SIZE_EBHSCR;
-    }
-    else {
+        break;
+
+    case 249: /* DLT_USBPCAP */
+        pcap_src->cap_pipe_max_pkt_size = WTAP_MAX_PACKET_SIZE_USBPCAP;
+        break;
+
+    default:
         pcap_src->cap_pipe_max_pkt_size = WTAP_MAX_PACKET_SIZE_STANDARD;
+        break;
     }
 
     if (hdr->version_major < 2) {
diff --git a/wiretap/pcap-common.c b/wiretap/pcap-common.c
index ee17770c74..4d64a7a777 100644
--- a/wiretap/pcap-common.c
+++ b/wiretap/pcap-common.c
@@ -737,25 +737,30 @@ wtap_wtap_encap_to_pcap_encap(int encap)
  * that should be enough for most link-layer types, and shouldn't be
  * too big.
  *
- * For D-Bus, we use WTAP_MAX_PACKET_SIZE_DBUS, because the maximum
- * D-Bus message size is 128MB, which is bigger than we'd want for
- * all link-layer types - files with that snapshot length might cause
- * some programs reading them to allocate a huge and wasteful buffer
- * and, at least on 32-bit platforms, run the risk of running out of
- * memory.
- * For EBHSCR, we use WTAP_MAX_PACKET_SIZE_EBHSCR, because the maximum
- * EBHSCR message size is 8MB
+ * For some link-layer types, we use larger types, because, for each
+ * of them, the maximum packet size is larger than the standard
+ * maximum, and is bigger than we'd want for all link-layer types - files
+ * with that snapshot length might cause some programs reading them to
+ * allocate a huge and wasteful buffer and, at least on 32-bit platforms,
+ * run the risk of running out of memory.
  */
 guint
 wtap_max_snaplen_for_encap(int wtap_encap)
 {
-	if (wtap_encap == WTAP_ENCAP_DBUS)
+	switch (wtap_encap) {
+
+	case WTAP_ENCAP_DBUS:
 		return WTAP_MAX_PACKET_SIZE_DBUS;
-	else if (wtap_encap == WTAP_ENCAP_EBHSCR)
+
+	case WTAP_ENCAP_EBHSCR:
 		return WTAP_MAX_PACKET_SIZE_EBHSCR;
-	else
-		return WTAP_MAX_PACKET_SIZE_STANDARD;
 
+	case WTAP_ENCAP_USBPCAP:
+		return WTAP_MAX_PACKET_SIZE_USBPCAP;
+
+	default:
+		return WTAP_MAX_PACKET_SIZE_STANDARD;
+	}
 }
 
 /*
diff --git a/wiretap/wtap.h b/wiretap/wtap.h
index af7dc2cdf3..d6c5153489 100644
--- a/wiretap/wtap.h
+++ b/wiretap/wtap.h
@@ -400,19 +400,29 @@ extern "C" {
 /* if you add to the above, update wtap_tsprec_string() */
 
 /*
- * We support one maximum packet size for most link-layer header types
- * and another for D-Bus, because the maximum packet size for D-Bus
- * is 128MB, as per
+ * Maximum packet sizes.
+ *
+ * For most link-layer types, we use 262144, which is currently
+ * libpcap's MAXIMUM_SNAPLEN.
+ *
+ * For WTAP_ENCAP_DBUS, the maximum is 128MiB, as per
  *
  *    https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages
  *
- * and that's a lot bigger than the 256KB that we use elsewhere.
+ * For WTAP_ENCAP_EBHSCR, the maximum is 8MiB, as per
+ *
+ *    https://www.elektrobit.com/ebhscr
+ *
+ * For WTAP_ENCAP_USBPCAP, the maximum is 1MiB, as per
+ *
+ *    https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15985
  *
- * We don't want to write out files that specify a maximum packet size of
- * 128MB if we don't have to, as software reading those files might
- * allocate a buffer much larger than necessary, wasting memory.
+ * We don't want to write out files that specify a maximum packet size
+ * greater than 262144 if we don't have to, as software reading those
+ * files might allocate a buffer much larger than necessary, wasting memory.
  */
 #define WTAP_MAX_PACKET_SIZE_STANDARD    262144
+#define WTAP_MAX_PACKET_SIZE_USBPCAP     (1024*1024)
 #define WTAP_MAX_PACKET_SIZE_EBHSCR      (8*1024*1024)
 #define WTAP_MAX_PACKET_SIZE_DBUS        (128*1024*1024)