Wireshark · Ethereal-dev: Re: [Ethereal-dev] tvbuff questions and conclusions...

[Guy Harris <gharris@xxxxxxxxxxxx>]

On Tue, Mar 13, 2001 at 11:50:22AM +0600, Diwakar Shetty wrote:
> I had tried this approach (i.e doing a "tvb_new_real_data()"...but it
> did not seem to work.....i was finding it difficult to pass control to
> this new data midway....and the biggest problem of all was that the
> third pane which shows the hex data still showed the earlier data...

All of those are consequences of the current lack of any notion, in
Ethereal, of there being more than one chunk of packet data for the
current frame.

That is what Jeff's work will add.

> so i
> thought the better way would be to change the "real_data" of the
> original "tv_buff" itself..... 

No.  That can cause all sorts of bad things to happen:

	crashes if the underlying packet data is read-only (which it
	currently isn't, but it may be read-only in the future);

	surprises for the code that manages the hex dump window, and for
	other dissectors that might expect the raw packet data *not* to
	change out from under it;

	arbitrary allocated data getting randomly trashed, if you try to
	change the real data to contain anything more than the size of
	the chunk of memory it's in.

> Of course, I know I am going against the ideas for which tvbuff was
> created..but what else can i do ??

You can wait for Jeff the stuff he's working on.