ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: [Ethereal-dev] slight confusion

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Ed Warnicke <hagbard@xxxxxxxxxxxxxxxxxxx>
Date: Thu, 10 May 2001 22:04:45 -0400 (EDT)
I am slightly confused about the overloaded use of the FIELDBASE
in association with the FT_BOOLEAN.  

The README.developer says:

"For FT_BOOLEAN fields that are also bitfields, 'display' is used to tell
the proto_tree how wide the parent bitfield is.  With integers this is
not needed since the type of integer itself (FT_UINT8, FT_UINT16,
FT_UINT24, FT_UINT32, etc.) tells the proto_tree how wide the parent
bitfield is."

Which leads me to believe that I can use the FIELDBASE and a mask 
to extract my boolean from some appropriately sized unsigned int type.
It fails however to indicate which FIELDBASE values correspond 
to which bitwidths.  

This becomes even more confusing on investigating the source.
The base types are defined in proto.h as 

enum {
        BASE_NONE,
        BASE_DEC,
        BASE_HEX,
        BASE_OCT,
        BASE_BIN
};

which in my understanding of the universe is equivalent to 

enum {
        BASE_NONE = 0,
        BASE_DEC = 1,
        BASE_HEX = 2,
        BASE_OCT = 3,
        BASE_BIN = 4  
};

since the only place I can find this overloaded use of the FIELDBASE 
is in proto.c, where it is returned from hfinfo_bitwidth() which 
returns the expected values of 8 for FT_UINT8, 16 for FT_UINT16, and 
so on, but for FT_BOOLEAN simply returns:

case FT_BOOLEAN:
                        bitwidth = hfinfo->display; /* hacky? :) */

this would seem to mean that I can't back my FT_BOOLEANS with anything 
bigger than a 4 bit wide value (the BASE_BIN case).  I don't think this is
really the case.  What am I misunderstanding?

Ed