Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 4563] certain edp display filters trigger Wireshark/tshark

Date: Mon, 8 Mar 2010 05:21:21 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4563

--- Comment #1 from Jaap Keuter <jaap.keuter@xxxxxxxxx> 2010-03-08 14:21:13 CET ---
Nice... you're not allowed to have a NULL tvb when adding fields. 
Now look how edp.unknown is added.
1.2.6:packet-extreme.c:dissect_unknown_tlv():line 947:
    unknown_item = proto_tree_add_protocol_format(tree, hf_edp_unknown,
        tvb, offset, length, "Unknown element [0x%02x]", tlv_type);

Looks oke. Now look at how this is handled:
1.2.6:proto.c:proto_tree_add_protocol_format():line 1476:
    if (start == 0) {
        proto_tree_set_protocol_tvb(new_fi, tvb);
    }
    else {
        proto_tree_set_protocol_tvb(new_fi, NULL);
    }

When start != 0 a NULL tvb is assigned as value.... That's where the display
filter compiler get's the value from when setting up the comparison. When time
comes to do the actual comparison it rightfully throws an exception on the tvb
being NULL.

I guess we should create a new tvb subset here.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.