Wireshark · Ethereal-dev: RE: [Ethereal-dev] Patch: better decoding of NTLMSSP address list

["Devin Heitmueller" <dheitmueller@xxxxxxxxxxx>]

Hello Guy,

The original change of item_offset from type int to guint16 was to address a signed-unsigned comparsion issue, and I mistyped 16 instead of 32.  The rest were just copies of item_offset.

Attached is a patch that uses guint32 in all cases.

Is there some reason that we commonly use "int" to describe offsets in dissectors, as opposed to guint32?  Is there any case where it is permissible to have negative offsets?

Thanks,

Devin Heitmueller


-----Original Message-----
From:	Guy Harris [mailto:guy@xxxxxxxxxxxx]
Sent:	Sat 8/30/2003 9:08 PM
To:	Devin Heitmueller
Cc:	ethereal-dev@xxxxxxxxxxxx
Subject:	Re: [Ethereal-dev] Patch: better decoding of NTLMSSP address list

On Saturday, August 23, 2003, at 8:50 AM, Devin Heitmueller wrote:

> Attached is a patch to better decode the NTLMSSP address list found in 
> the challenge packet.  It fleshes out the decoding of the individual 
> items to show how the type and lengths are determined.

Why are some offsets into the packet made 16 bits long?  That runs the 
risk of rude surprises if they overflow 16 bits, unless NTLMSSP 
specifies module-64K arithmetic in that case.

Attachment: packet-ntlmssp.c.diff.2.gz
Description: packet-ntlmssp.c.diff.2.gz