ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] string manipulation

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 25 Jan 2010 13:50:54 -0800
On Jan 25, 2010, at 1:31 PM, Gerald Combs wrote:

> Assuming hf_helen_flowname is an FT_STRING, couldn't you dispense with
> the string-fetching and ptr-tracking entirely and just use
> 
>    proto_tree_add_item(helen_sub_tree, hf_helen_flowname, tvb,
>        offset, 8, FALSE);
> 
> ?

It looks as if it's a zero-padded string; that will happen to work currently, as string values are null-terminated and if there are any padding bytes, the first of them will terminate the string.

We might want to have an FT_STRINGZPAD type, to make it clear that some fields are zero-padded rather than counted or null-terminated.