Wireshark mailing list archives

Re: proto_tree_add_item() calls where length doesn't match type of hf item


From: Guy Harris <gharris () sonic net>
Date: Fri, 16 Oct 2020 15:14:46 -0700

On Oct 16, 2020, at 2:54 PM, Martin Mathieson <martin.r.mathieson () googlemail com> wrote:

There might be some protocols where there was (say) a 7 byte integer field, so the dissector writer had to round it 
up to the nearest supported size, but again I didn't see that.

That's because the nearest supported size is FT_{U}INT56, so no rounding up would have been necessary unless there was 
a time after we introduced FT_{U}INT64 but before we introduced FT_{U}INT{40,48,56}.

Another clue is the amount by which 'offset' might be added to in the very next line (i.e. which size does it 
match?), but that would be hard to reliably parse.

Sadly, C is far from being a good packet description language.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

Current thread: