[Winpcap-users] pcap_fopen_offline() and pcap_close()
guy at alum.mit.edu
Fri Jan 27 18:00:01 PST 2012
On Jan 27, 2012, at 2:34 AM, Boaz Brickner wrote:
> In Pcap.Net (http://pcapdot.net), I'm using pcap_fopen_offline() to open files.
> Since this function assumes the FILE* argument it gets is already open, does calling pcap_close() on its output also closes that FILE*
Yes, it does.
And, yes, this does, I think, run the risk that you'll open the FILE * with one version of the C runtime library and have WinPcap close it with another version, which I am told
1) can happen
2) can cause crashes and other problems.
(I come from the UN*X world, where that sort of mismatched-versions-of-the-C-library problem simply doesn't happen. You can allocate stuff in a library and free it in the main program or another library, and open a FILE * in the main program and close it in a library or open it in a library and close it in the main program or another library, and all the operations will be done by the same version of the C library.)
If this is causing problems, you might want to see whether you can use pcap_hopen_offline() with a HANDLE instead.
More information about the Winpcap-users