ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] ptvcursor : one step further?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 26 Dec 2006 16:02:20 -0800
Sebastien Tandel wrote:

What is done hereabove when playing with subtrees is like acting as
push/pop actions => then add this feature in the ptvcursor API. It can
be done in the following way :
- add a field in the ptvcursor structure which retains the push/pop of
subtrees (fixed-length table, only one level of push/pop, malloc/free?)

I'd vote for multiple levels, with, perhaps, an allocator with its own free list, so that popping adds to the beginning of the free list.

- add two functions : ptvcursor_push_subtree(cursor, it, ett_sub),
ptvcursor_pop_subtree(cursor)

I might also suggest that, when you have an item with a subtree, and that item doesn't correspond to a primitive type (if, for example, you have an item that's a 32-bit flag word, with the subtree items being individual bits in the flag word, the item is a primitive type, namely a FT_UINT32; however, if the item is an array or structure, it's not a primitive type, so it doesn't have a value and might not even have a fixed length), there should be a way of creating an item with unknown length and with a subtree, and when you pop (or "close") the subtree, that'd set the length of the item.

The "create item with subtree" operation would create the item without advancing the cursor, and push a subtree; that might be done as a combination of ptvcursor_add_no_advance() and ptvcursor_push_subtree(). The "close subtree" operation would do a ptvcursor_pop_subtree() and then set the length of the parent item to the difference between the current ptvcursor offset and the starting offset of the parent item.