Expand a comment to explain why we clamp the snaphot length.

[skip ci]

diff --git a/pcap-int.h b/pcap-int.h
index 9a46019cb2f142dcb34da644f1650c448f0be786..6fe535a3f44bd85bc841052d1374d9c66b1dc6d9 100644 (file)
--- a/pcap-int.h
+++ b/pcap-int.h
@@ -86,7 +86,12 @@ extern "C" {
  *    2) small enough not to cause attempts to allocate huge amounts of
  *       memory; some applications might use the snapshot length in a
  *       savefile header to control the size of the buffer they allocate,
- *       so a size of, say, 2^31-1 might not work well.
+ *       so a size of, say, 2^31-1 might not work well.  (libpcap uses it
+ *       as a hint, but doesn't start out allocating a buffer bigger than
+ *       2 KiB, and grows the buffer as necessary, but not beyond the
+ *       per-linktype maximum snapshot length.  Other code might naively
+ *       use it; we want to avoid writing a too-large snapshot length,
+ *       in order not to cause that code problems.)
  *
  * We don't enforce this in pcap_set_snaplen(), but we use it internally.
  */