Wireshark-dev: [Wireshark-dev] why is tvb->realdata not null for a tvb of type TVBUFF_SUBSET
From: "Chidamabaram Arunachalam" <[email protected]>
Date: Tue, 26 Feb 2008 07:46:16 -0500
Hi Team,

I am new to wireshark development and need help with the following:

From my understanding, when a tvb is of type of "TVBUFF_SUBSET", its real_data needs to be NULL.

My dissector registers to decode rtp packets of a user given RTP payload type.

I have a problem in which tvb received from rtp dissector is of type TVBUFF_SUBSET but the tvb->real_data is not NULL.

This is causing problem with tvb_memcpy in which "if (tvb->real_data)" gets validated as true and the real_data gets copied
instead of copying the tcbuffs.subset.tvb

Snip of tvb_memcpy:

tvb_memcpy(tvbuff_t *tvb, void* target, gint offset, gint length)
    guint    abs_offset, abs_length;

    DISSECTOR_ASSERT(length >= -1);
    check_offset_length(tvb, offset, length, &abs_offset, &abs_length);

    if (tvb->real_data) {
        return memcpy(target, tvb->real_data + abs_offset, abs_length);

    switch(tvb->type) {
        case TVBUFF_REAL_DATA:

        case TVBUFF_SUBSET:
            return tvb_memcpy(tvb->tvbuffs.subset.tvb, target,
                    abs_offset - tvb->tvbuffs.subset.offset,

        case TVBUFF_COMPOSITE:
            return composite_memcpy(tvb, target, offset, length);

    return NULL;

Please let me know your thoughts.