ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] tvbuff problem

From: Paul Forgey <paulf@xxxxxxxxxxxxx>
Date: Thu, 21 Dec 2006 15:34:49 -0800
On Tue, 19 Dec 2006 09:27:29 -0800, Stephen Fisher wrote:

Could you send the code you're trying to use the composite in?

That's sort of most the code right now. That's why I posted the gdb output because that pretty neatly sums up the problem. One way I can work around this is to do an evil hack like:

tvb_composite_finalize (data);
data->reported_length = tvb_length (data);

Because any of the offset checkers in tvbuff.c compare the index against the reported length and throw a bounds exception if it goes past it. When the composite tvbuff is created, the reported_length starts off as 0 and is not updated by tvb_composite_append () or tvb_composite_prepend ().

Here's specifically what I am doing, and some other problems with it as well:

data = tvb_new_composite ();

...

tvb_composite_append (data, tvb_new_subset (tvb, start, length, length));
(repeat 0-n times)

tvb_composite_finalize (data);
/* XXX hack */
data->reported_length = tvb_length (data);

The secondary problem with this is when using the composite buffer in proto_tree_add_item (). The offset from the first buffer is highlighted for the _total duration_, even though the composite covers discontinuous regions. Is there any easy way for a single tree item to highlight discontinuous regions of the capture data?

Finally, this entire process may be recursively applied in my project. If I create composite buffers from subsets of composite buffers, tvb_free_chain () eventually crashes when the root packet data is free'd by wireshark.

So what am I not understanding?

Attachment: smime.p7s
Description: S/MIME cryptographic signature