Wireshark · Wireshark-dev: [Wireshark-dev] why is tvb->realdata not null for a tvb of type TVBUFF_SUBSET

[Arun <arunwkdev@xxxxxxxxx>]

Hi Team,

I am new to wireshark development and need help with the following:

From my understanding, when a tvb is of type of "TVBUFF_SUBSET", its real_data needs to be NULL.

My dissector registers to decode rtp packets of a user given RTP payload type.

I have a problem in which tvb received from rtp dissector is of type TVBUFF_SUBSET but the tvb->real_data is not NULL.

This is causing problem with tvb_memcpy in which "if (tvb->real_data)" gets validated as true and the real_data gets copied

instead of copying the tcbuffs.subset.tvb

Snip of tvb_memcpy:

void*
tvb_memcpy(tvbuff_t *tvb, void* target, gint offset, gint length)
{
    guint    abs_offset, abs_length;

    DISSECTOR_ASSERT(length >= -1);

    check_offset_length(tvb, offset, length, &abs_offset, &abs_length);

    if (tvb->real_data) {
        return memcpy(target, tvb->real_data + abs_offset, abs_length);
    }

    switch(tvb->type) {

        case TVBUFF_REAL_DATA:
            DISSECTOR_ASSERT_NOT_REACHED();

        case TVBUFF_SUBSET:
            return tvb_memcpy(tvb->tvbuffs.subset.tvb, target,
                    abs_offset - tvb->tvbuffs.subset.offset,

                    abs_length);

        case TVBUFF_COMPOSITE:
            return composite_memcpy(tvb, target, offset, length);
    }

    DISSECTOR_ASSERT_NOT_REACHED();
    return NULL;
}


Please let me know your thoughts.

Thanks,
Arun