Wireshark-dev: Re: [Wireshark-dev] ptvcursor : one step further?
From: Guy Harris <[email protected]>
Date: Tue, 26 Dec 2006 16:02:20 -0800
Sebastien Tandel wrote:

What is done hereabove when playing with subtrees is like acting as
push/pop actions => then add this feature in the ptvcursor API. It can
be done in the following way :
- add a field in the ptvcursor structure which retains the push/pop of
subtrees (fixed-length table, only one level of push/pop, malloc/free?)
I'd vote for multiple levels, with, perhaps, an allocator with its own 
free list, so that popping adds to the beginning of the free list.
- add two functions : ptvcursor_push_subtree(cursor, it, ett_sub),
I might also suggest that, when you have an item with a subtree, and 
that item doesn't correspond to a primitive type (if, for example, you 
have an item that's a 32-bit flag word, with the subtree items being 
individual bits in the flag word, the item is a primitive type, namely a 
FT_UINT32; however, if the item is an array or structure, it's not a 
primitive type, so it doesn't have a value and might not even have a 
fixed length), there should be a way of creating an item with unknown 
length and with a subtree, and when you pop (or "close") the subtree, 
that'd set the length of the item.
The "create item with subtree" operation would create the item without 
advancing the cursor, and push a subtree; that might be done as a 
combination of ptvcursor_add_no_advance() and ptvcursor_push_subtree(). 
 The "close subtree" operation would do a ptvcursor_pop_subtree() and 
then set the length of the parent item to the difference between the 
current ptvcursor offset and the starting offset of the parent item.