Pcapng option bounds check (#4699)

* Fix PCAPNG options bounds check

Bounds check in PcapNG options is off-by-one, meaning that tightly packed options accidentally truncate the last option. Use right comparison to get that last option.

* Add regression test for PCAPNG options bounds

Author: tf2spi

scapy/utils.py

@@ -1800,7 +1800,7 @@ def _read_options(self, options):
                 warning("PcapNg: options header is too small "
                         "%d !" % len(options))
                 raise EOFError
-            if code != 0 and 4 + length < len(options):
+            if code != 0 and 4 + length <= len(options):
                 opts[code] = options[4:4 + length]
             if code == 0:
                 if length != 0:

test/regression.uts

@@ -2348,6 +2348,11 @@ file = BytesIO(b'\xd4\xc3\xb2\xa1\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x0
 l = rdpcap(file)
 assert len(l) == 0 or ARP in l[0]
 
+# Read PCAPNG file with tightly packed comment option, no End of Options
+file = BytesIO(b'\n\r\r\n\x1c\x00\x00\x00M<+\x1a\x01\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\x1c\x00\x00\x00\x01\x00\x00\x00\x14\x00\x00\x00\x01\x00\x00\x00\x00\x00\x04\x00\x14\x00\x00\x00\x06\x00\x00\x00,\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x08\x00Helloooo,\x00\x00\x00')
+l = rdpcap(file)
+assert len(l) == 1 and l[0].comment == b'Helloooo'
+
 = Read a pcap file with wirelen != captured len
 pktpcapwirelen = rdpcap(pcapwirelenfile)