tcpdump mailing list archives
Re: After invoking pcap_compile 15 times I get "too many registers needed to evaluate expression"
From: Guy Harris <guy () alum mit edu>
Date: Thu, 25 Oct 2007 17:50:15 -0700
On Oct 24, 2007, at 8:44 AM, Thomas King wrote:
I use libpcap 0.9.7 as provided by openSuSE 10.3. The problem I face is exemplified in the source code I attached to this email. The source code is an artificially created example to pin-point the problem I have. Everythingworks create until pcap_compile is invoked the 15th times. As I callpcap_freecode at the end of each loop I would assume that the filter memoryshould be freed.
The registers in question aren't filter-memory resources; the BPF pseudo-machine has 16 scratch memory locations, and if the code generator runs out of scratch memory locations, it fails with that error.
What is wrong with my program? Or is this a bug in libpcap?
It's a bug in libpcap. I've checked in a fix. (It should only show up if you're capturing from a device that supplies radiotap headers or if you're reading from a capture file with radiotap headers.)
BTW, you can (and perhaps should) call pcap_freecode() after calling pcap_setfilter() - pcap_setfilter() makes a copy of the filter if necessary, so the original filter can be freed.
- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- After invoking pcap_compile 15 times I get "too many registers needed to evaluate expression" Thomas King (Oct 24)
- Re: After invoking pcap_compile 15 times I get "too many registers needed to evaluate expression" Guy Harris (Oct 25)