ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] tvb_reported_length() vs tvb_length()

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 25 Sep 2009 16:36:42 -0400
Guy Harris wrote:
On Sep 24, 2009, at 1:08 PM, Bill Meier wrote:
What are the cases where the use of tvb_length... in a dissctors is valid ?

Off the top of my head, I'd say it's valid if:

Looking at README.developer in detrail I see that:

1. tvb_length is shown as being used before doing a heuristics check in
   new-style (and presumably heuristics) dissectors.
   In fact: I now see that the return is shown as
   tvb_length not tvb_reported_length.
   (Given this, I made an incorrect commit in a recent commit).

...you're doing a check of some sort before you start dissecting, such as a heuristic dissector test, and you need to know how much data is actually available so you don't throw an exception and abort the dissection or...

Schwoo, Bill's email had me worrying that what I put in README.developer wasn't right (I think I copied the behavior from some new-style dissector without putting a lot of thought into it). I'll see about adding some words to the effect of "please be careful not to throw an exception while doing these heuristics."