Wireshark · Ethereal-dev: Re: [Ethereal-dev] Update to expert data

[Gilbert Ramirez <gram@xxxxxxxxxxxxxxx>]

Thanks for looking into this and your current NCP work.

Is there more to look for?

--gilbert

On 10/21/05, Guy Harris <gharris@xxxxxxxxx> wrote:
> Gilbert Ramirez wrote:
>
> > I'll look into the NCP dissector, which I mostly wrote but haven't
> > looked at in a long time, and find out what's happening. It does do
> > weird things because it's table-driven, but i wouldn't expect it to be
> > totally broken in regards to the rest of ethereal.
>
> ptvcursor_add() doesn't work correctly with FT_UINT_BYTES or
> FT_UINT_STRING fields if the tree argument is null, because the length
> passed to it is the length of the length field, and if the tree argument
> is null that doesn't get fetched or used, and the ptvcursor isn't moved
> by the right amount.
>
> I have a version of ptvcursor_add() that I've moved into proto.c, which,
> instead of calling proto_tree_add_item(), uses routines that, in my
> version, proto_tree_add_item() calls, so that it duplicates the (now
> small) contents of proto_tree_add_item() (the actual work of
> proto_tree_add_item() is done with common routines).
>
> The ptvcursor routines are, I think, currently only being used by the
> NCP dissector; a lot of dissectors might be simplified if we used them.
>   We might want to incorporate them into proto.c and perhaps switch to
> using them in place of the proto_tree_add routines (and adding new
> routines as necessary to replace those routines).
>
> Also, make sure all the tapping code is called even if the tree argument
> is null.
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
>