Currently pcap_frame() assumes that if write() doesn't return an error, it has written everything we want. That's not necessarily true, because it could return a short write. That's not likely to happen on a regular file, but there's not a lot of reason not to be robust here; it's conceivable we might want to direct the pcap fd at a named pipe or similar. So, make pcap_frame() handle short frames by using the write_remainder() helper. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- pcap.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/pcap.c b/pcap.c index 5cd7a8cc..317fc844 100644 --- a/pcap.c +++ b/pcap.c @@ -77,15 +77,18 @@ static void pcap_frame(const struct iovec *iov, size_t offset, const struct timeval *tv) { size_t len = iov->iov_len - offset; - struct pcap_pkthdr h; - - h.tv_sec = tv->tv_sec; - h.tv_usec = tv->tv_usec; - h.caplen = h.len = len; - - if (write(pcap_fd, &h, sizeof(h)) < 0 || - write(pcap_fd, (char *)iov->iov_base + offset, len) < 0) - debug("Cannot log packet, length %zu", len); + struct pcap_pkthdr h = { + .tv_sec = tv->tv_sec, + .tv_usec = tv->tv_usec, + .caplen = len, + .len = len + }; + struct iovec hiov = { &h, sizeof(h) }; + + if (write_remainder(pcap_fd, &hiov, 1, 0) < 0 || + write_remainder(pcap_fd, iov, 1, offset) < 0) + debug("Cannot log packet, length %zu: %s", + len, strerror(errno)); } /** -- 2.43.2