Wireshark · Ethereal-dev: Re: [Ethereal-dev] Patch: better decoding of NTLMSSP address list

[Guy Harris <guy@xxxxxxxxxxxx>]

(My original mail on this may have bounced, so I'm regenerating it.)

On Sun, Aug 31, 2003 at 09:26:39AM -0400, Devin Heitmueller wrote:
> Attached is a patch that uses guint32 in all cases.

Checked in.

> Is there some reason that we commonly use "int" to describe offsets in
> dissectors, as opposed to guint32? Is there any case where it is
> permissible to have negative offsets?

Most, if not all, of the routines that fetch stuff from tvbuffs can take
a negative offset, which means an offset relative to the end of the
packet (end of the packet, rather than end of the tvbuff, i.e. it bases
it on the reported length of the packet, not on the amount of data
actually captured).

I don't know whether any dissector actually uses that feature, but it is
present in the tvbuff code.