Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] WireShark crashes when I try to use a filter on my plugin di

From: Bill Fassler <bill.fassler@xxxxxxxxx>
Date: Wed, 20 Sep 2006 08:17:42 -0700 (PDT)
You nailed it Gilbert!  My string value array was missing the last necessary record of :

 { 0, NULL }
w
The reason I removed it was because we identify a NOP command as 0x00.  I put this final record in and I no longer get a run time fatal error and crash.  It looks like my filters are working.  My concern now is that the first and last entries are zero.  Could this create any run time problems?

{0x00, "No Operation"}
.
.
.
{0, NULL}

Gilbert Ramirez <gram@xxxxxxxxxxxxxxx> wrote:
On 9/19/06, Bill Fassler wrote:
> Thanks Guy, Jaap et al for helping me through this. My plugin dissector
> seems to be working pretty well until I try to filter on something. When I
> open the _expression_ box and then expand my plugin filter(s), as soon as I
> select the field I want to filter and click my mouse on it, the whole
> application crashes and closes. It doesn't seem to be an isolated anomoly.
> I've been able to repeat the process and recreate the problem with
> consistency.
>
> Here is a snippet from my protocol field array which happens to be what I am
> trying to filter on (although I think it crashes no matter what I try to
> filter on)
>
> { &hf_ctrl_cmd,
> { "Control Channel Command",
> "vppn.cmd",
> FT_UINT8, BASE_HEX, VALS(control_channel_commands), 0x0,
> "", HFILL }},
>
> I don't define or declare vppn.cmd anywhere other than here, did I miss
> something or do something wrong?
>

In your control_channel_commands value_string array, is the last record:

{ 0, NULL }

?

Wireshark needs that terminating record to know when to stop iterating
across the value_string list.

--gilbert
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev


Stay in the know. Pulse on the new Yahoo.com. Check it out.