Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] tvbuff problem

From: Paul Forgey <paulf@xxxxxxxxxxxxx>
Date: Thu, 21 Dec 2006 15:34:49 -0800
On Tue, 19 Dec 2006 09:27:29 -0800, Stephen Fisher wrote:

Could you send the code you're trying to use the composite in?

That's sort of most the code right now. That's why I posted the gdb output because that pretty neatly sums up the problem. One way I can work around this is to do an evil hack like:

tvb_composite_finalize (data);
data->reported_length = tvb_length (data);

Because any of the offset checkers in tvbuff.c compare the index against the reported length and throw a bounds exception if it goes past it. When the composite tvbuff is created, the reported_length starts off as 0 and is not updated by tvb_composite_append () or tvb_composite_prepend ().

Here's specifically what I am doing, and some other problems with it as well:

data = tvb_new_composite ();

...

tvb_composite_append (data, tvb_new_subset (tvb, start, length, length));
(repeat 0-n times)

tvb_composite_finalize (data);
/* XXX hack */
data->reported_length = tvb_length (data);

The secondary problem with this is when using the composite buffer in proto_tree_add_item (). The offset from the first buffer is highlighted for the _total duration_, even though the composite covers discontinuous regions. Is there any easy way for a single tree item to highlight discontinuous regions of the capture data?

Finally, this entire process may be recursively applied in my project. If I create composite buffers from subsets of composite buffers, tvb_free_chain () eventually crashes when the root packet data is free'd by wireshark.

So what am I not understanding?

Attachment: smime.p7s
Description: S/MIME cryptographic signature