Wireshark mailing list archives

Re: Best way to handle a variable-length NULL-terminated string in a tvb


From: "Jeremy O'Brien" <obrien654j () gmail com>
Date: Mon, 3 May 2010 11:08:01 -0400

Separated by. tvb_get_stringz is exactly what I was looking for. Thank you!

On Fri, Apr 30, 2010 at 15:42, Guy Harris <guy () alum mit edu> wrote:

On Apr 30, 2010, at 12:33 PM, Jeremy O'Brien wrote:

So I have several strings in my protocol, which are separated by
NULL's.

Separated by, or terminated by?

I.e., is there a NUL at the end of the *last* string, or just in *between* strings?

There is no information contained in the packet that gives the
length of each string. Is there a better way to add these strings to
the protocol dissection besides doing a tvb_get_ephemeral_string() on
the section of the tvb in question, searching for the ending NULL's
for each string, and manually incrementing the offset for each one?
I'm just not sure if wireshark has any convenience functions that
would handle this sort of situation.

/**
 * Given a tvbuff and an offset, with the offset assumed to refer to
 * a null-terminated string, find the length of that string (and throw
 * an exception if the tvbuff ends before we find the null), allocate
 * a buffer big enough to hold the string, copy the string into it,
 * and return a pointer to the string.  Also return the length of the
 * string (including the terminating null) through a pointer.
 *
 * tvb_get_stringz() returns a string allocated by g_malloc() and therefore
 *                   MUST be g_free() by the caller in order not to leak
 *                   memory.
 *
 * tvb_get_ephemeral_stringz() returns a string that does not need to be freed,
 *                   instead it will automatically be freed once the next
 *                   packet is dissected.
 *
 * tvb_get_seasonal_stringz() returns a string that does not need to be freed,
 *                   instead it will automatically be freed when a new capture
 *                   or file is opened.
 */
extern guint8 *tvb_get_stringz(tvbuff_t *tvb, const gint offset, gint *lengthp);
extern guint8 *tvb_get_ephemeral_stringz(tvbuff_t *tvb, const gint offset, gint *lengthp);
extern guint8 *tvb_get_seasonal_stringz(tvbuff_t *tvb, const gint offset, gint *lengthp);

You presumably want tvb_get_ephemeral_stringz().
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe


Current thread: