Ettercap/ettercap — pull request #96 by jacob-baines (2013-03-02 13:09:28+00:00)
Title: Fixed uninitialized value (pcap file size) due to fstat failure

## Setup
OS: Ubuntu 12.10 32 bit
Ettercap Version: Github master (commit 7ab56a2196f032f67a6d95eaa1974f2af7893913)

## Symptoms:
1. Valgrind reports this error when running "ettercap -r -T":

==21985== Thread 3:
==21985== Conditional jump or move depends on uninitialised value(s)
==21985== at 0x805984A: ec_decode (ec_decode.c:228)
==21985== by 0x48BF5CA: ??? (in /usr/lib/i386-linux-gnu/libpcap.so.1.3.0)
==21985== by 0x48B03DE: pcap_loop (in /usr/lib/i386-linux-gnu/libpcap.so.1.3.0)
==21985== by 0x80569E8: capture (ec_capture.c:125)
==21985== by 0x488BD4B: start_thread (pthread_create.c:308)
==21985== by 0x49FED3D: clone (clone.S:130)
==21985==

2. Ettercap simply hangs after processing a file. I actually did not realize that was unexpected until I fixed the above.

## The Error
ec_decode.c:228 is this line:

if (GBL_OPTIONS->read && GBL_PCAP->dump_size == GBL_PCAP->dump_off)

The complaint is that GBL_PCAP->dump_size is uninitialized (and thus incorrect).

GBL_PCAP->dump_size is supposed to be set at ec_network.c:193. However, the return value of pcap_fileno in ec_network.c:192 was returning an invalid handle which caused fstat to fail.

## The Fix:
Interestingly, pcap_fileno's man page indicates that pcap_activate needs to be called before pcap_fileno, but I didn't seem to have much luck. Instead, I switched from using pcap_fileno to pcap_file to get the FILE* and then fileno in conjunction with fstat. Once I did that the dump_size was properly populated and ettercap properly closes after processing the file.