Wireshark · Ethereal-dev: Re: [Ethereal-dev] Update to expert data

[Guy Harris <gharris@xxxxxxxxx>]

Gilbert Ramirez wrote:

> I'll look into the NCP dissector, which I mostly wrote but haven't
> looked at in a long time, and find out what's happening. It does do
> weird things because it's table-driven, but i wouldn't expect it to be
> totally broken in regards to the rest of ethereal.

ptvcursor_add() doesn't work correctly with FT_UINT_BYTES or 
FT_UINT_STRING fields if the tree argument is null, because the length 
passed to it is the length of the length field, and if the tree argument 
is null that doesn't get fetched or used, and the ptvcursor isn't moved 
by the right amount.

I have a version of ptvcursor_add() that I've moved into proto.c, which, 
instead of calling proto_tree_add_item(), uses routines that, in my 
version, proto_tree_add_item() calls, so that it duplicates the (now 
small) contents of proto_tree_add_item() (the actual work of 
proto_tree_add_item() is done with common routines).

The ptvcursor routines are, I think, currently only being used by the 
NCP dissector; a lot of dissectors might be simplified if we used them. 
 We might want to incorporate them into proto.c and perhaps switch to 
using them in place of the proto_tree_add routines (and adding new 
routines as necessary to replace those routines).

Also, make sure all the tapping code is called even if the tree argument 
is null.