*Always* write out the trailing pcapng block total length in host byte order.

In the fast-path "no options" case for writing an Enhanced Packet Block,
just copy the block total length to the buffer, don't put it into the
buffer in little-endian byte order.  If we're running on a big-endian
machine, and thus *should* be writing out multi-byte integral block
fields in big-endian byte order, that'll write out a corrupt pcapng
file.

Bug: 13802
Change-Id: I33958e3fc1d205ca6df3ef4057d92b461831c50e
Reviewed-on: https://code.wireshark.org/review/22753
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

1 files changed, 6 insertions, 8 deletions

diff --git a/writecap/pcapio.c b/writecap/pcapio.c
index 1336f735c3..abc0af929a 100644
--- a/writecap/pcapio.c
+++ b/writecap/pcapio.c
@@ -550,20 +550,18 @@ pcapng_write_enhanced_packet_block(FILE* pfile,
         if(caplen % 4) {
             pad_len = 4 - (caplen % 4);
         }
+        /*
+         * If we have no options to write, just write out the padding and
+         * the block total length with one fwrite() call.
+         */
         if(!comment && flags == 0 && options_length==0){
             /* Put padding in the buffer */
             for (i = 0; i < pad_len; i++) {
                 buff[i] = 0;
             }
             /* Write the total length */
-            buff[i] = (block_total_length & 0x000000ff);
-            i++;
-            buff[i] = (block_total_length & 0x0000ff00) >> 8;
-            i++;
-            buff[i] = (block_total_length & 0x00ff0000) >> 16;
-            i++;
-            buff[i] = (block_total_length & 0xff000000) >> 24;
-            i++;
+            memcpy(&buff[i], &block_total_length, sizeof(guint32));
+            i += sizeof(guint32);
             return write_to_file(pfile, (const guint8*)&buff, i, bytes_written, err);
         }
         if (pad_len) {