[pcap-ng-format] Section length in the SHB

[Guy Harris]

Currently, the spec says:

	Section Length: a signed 64-bit value specifying the length in bytes of the following section, excluding the Section Header Block itself. This field can be used to skip the section, for faster navigation inside large files. Section Length equal -1 (0xFFFFFFFFFFFFFFFF) means that the size of the section is not specified, and the only way to skip the section is to parse the blocks that it contains. Please note that if this field is valid (i.e. not negative), its value is always aligned to 32 bits, as all the blocks are aligned to and padded to 32-bit boundaries.

Before Hadriel's change, it said:

	Section Length: 64-bit value specifying the length in bytes of the following section, excluding the Section Header Block itself. This field can be used to skip the section, for faster navigation inside large files. Section Length equal -1 (0xFFFFFFFFFFFFFFFF) means that the size of the section is not specified, and the only way to skip the section is to parse the blocks that it contains. Please note that if this field is valid (i.e. not -1), its value is always aligned to 32 bits, as all the blocks are aligned to and padded to 32-bit boundaries.

and his comment in response to a question was:

	I was actually going to change the whole thing to say it's an *unsigned* 64-bit value, and max value (0xFFFFFFFFFFFFFFFF) meant "unknown" but any other value was the length of the section. But I thought that might be a controversial change. So I changed it to this because the previous wording implied other negative numbers were valid lengths, which clearly they're not.

The previous warning was unfortunate, as it didn't *explicitly* say "signed 64-bit value", but, by speaking of -1 rather than 0xFFFFFFFFFFFFFFFF or 18446744073709551615, it at least suggested that it be signed.

So I'm not sure whether explicitly declaring it to be unsigned would be a problem or not.

If it would, we need to say what should be done for negative values other than -1.  Fail?  Treat *all* negative values as meaning "unknown"?

If it wouldn't, I'd vote for making it unsigned, and saying that 0xFFFFFFFFFFFFFFFF means "unknown" and not speaking of -1. (Note that increasing the maximum specifiable size from 9223372036854775807 to 18446744073709551615, by going to unsigned, is likely to make a difference any time soon; if we ever get to the point where we have technologies for storing files with more than 9223372036854775807 bytes, I'm sure we can go with pcapng 2.0 and a 128-bit or larger section size. :-))