Wireshark · Ethereal-dev: [Ethereal-dev] FT_IPv4 and little_endian = 1 (Bug report for proto_tree_add_item)

[Peter Johansson <Peter.xc.Johansson@xxxxxxxxxxxx>]

The protocol I am writing a dissector for sends (among other things) the 
IP address that the data connection should be made on (similar to FTP).
The problem I have is that the IP v4 address is in little endian format 
in the protocol data. Hence I tried:

proto_tree_add_item(dsd_tree,
                   hf_dsd_ip_address_1,
                   tvb,
                   OCP_HEADER_SIZE + DSD_HEADER_SIZE + 6,
                   4,
                   TRUE); /* DATA IS LITTLE ENDIAN */


hf_dsd_ip_address_1 is defined as:
&hf_dsd_ip_address_1,
{
  "IP address 1", "ocp.dsd.addr_1",
  FT_IPv4, BASE_NONE, NULL, 0x0,
  ""
}

The problem is that the address that should be shown as i.e. 192.168.1.2 
is shown as 2.1.168.192 since proto_tree_add_item in proto.c ignores the 
little_endian flag  for the type FT_IPv4.
Is this by design or is it a misfeature (bug)?

I suggest a change in proto.c from:
proto_tree_set_ipv4(new_fi, value);

to:
proto_tree_set_ipv4(new_fi, little_endian ? GUINT32_TO_BE(value) : value);
Since proto_tree_set_ipv4 expects big endian data, the value must be 
converted to BE if LE.

diff -u information follows:

--- proto.c     Fri Aug 13 00:41:54 2004
+++ modified_proto.c    Thu Sep 02 12:06:25 2004
@@ -722,7 +722,7 @@
               case FT_IPv4:
                       g_assert(length == 4);
                       tvb_memcpy(tvb, (guint8 *)&value, start, 4);
-                       proto_tree_set_ipv4(new_fi, value);
+                       proto_tree_set_ipv4(new_fi, little_endian ? 
GUINT32_TO_BE(value) : value);
                       break;

               case FT_IPXNET:

/ Regards, Peter