Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Best way to handle a variable-length NULL-terminated string

Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 30 Apr 2010 12:42:34 -0700
On Apr 30, 2010, at 12:33 PM, Jeremy O'Brien wrote:

> So I have several strings in my protocol, which are separated by
> NULL's.

Separated by, or terminated by?

I.e., is there a NUL at the end of the *last* string, or just in *between* strings?

> There is no information contained in the packet that gives the
> length of each string. Is there a better way to add these strings to
> the protocol dissection besides doing a tvb_get_ephemeral_string() on
> the section of the tvb in question, searching for the ending NULL's
> for each string, and manually incrementing the offset for each one?
> I'm just not sure if wireshark has any convenience functions that
> would handle this sort of situation.

/**
 * Given a tvbuff and an offset, with the offset assumed to refer to
 * a null-terminated string, find the length of that string (and throw
 * an exception if the tvbuff ends before we find the null), allocate
 * a buffer big enough to hold the string, copy the string into it,
 * and return a pointer to the string.  Also return the length of the
 * string (including the terminating null) through a pointer.
 *
 * tvb_get_stringz() returns a string allocated by g_malloc() and therefore
 *                   MUST be g_free() by the caller in order not to leak
 *                   memory.
 *
 * tvb_get_ephemeral_stringz() returns a string that does not need to be freed,
 *                   instead it will automatically be freed once the next
 *                   packet is dissected.
 *
 * tvb_get_seasonal_stringz() returns a string that does not need to be freed,
 *                   instead it will automatically be freed when a new capture
 *                   or file is opened.
 */
extern guint8 *tvb_get_stringz(tvbuff_t *tvb, const gint offset, gint *lengthp);
extern guint8 *tvb_get_ephemeral_stringz(tvbuff_t *tvb, const gint offset, gint *lengthp);
extern guint8 *tvb_get_seasonal_stringz(tvbuff_t *tvb, const gint offset, gint *lengthp);

You presumably want tvb_get_ephemeral_stringz().