Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Dynamic value string

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 9 Sep 2011 09:56:49 -0700
On Sep 9, 2011, at 9:49 AM, Sylvain Munaut wrote:

> My idea was to extend the value_string to include a 'DYNAMIC' version
> where a call back of the dissector would be called with the value and
> should return a string to display.
> 
> Obviously that string would have to be g_malloc'ed by the callback and
> then g_free'ed by the caller. (or give a buffer to write into to the
> call back, but then there is a size limit).
> 
> Is there any solution I missed ?

Well, at least in 1.6.x and later (I don't know whether this was supported in 1.4.x), doc/README.developer says:

	display
	-------
	The display field has a couple of overloaded uses. This is unfortunate,
	but since we're using C as an application programming language, this sometimes
	makes for cleaner programs. Right now I still think that overloading
	this variable was okay.

	For integer fields (FT_UINT* and FT_INT*), this variable represents the
	base in which you would like the value displayed.  The acceptable bases
	are:
   
	        BASE_DEC,
	        BASE_HEX,
	        BASE_OCT,
	        BASE_DEC_HEX,
	        BASE_HEX_DEC,
	        BASE_CUSTOM
   
	BASE_DEC, BASE_HEX, and BASE_OCT are decimal, hexadecimal, and octal,
	respectively. BASE_DEC_HEX and BASE_HEX_DEC display value in two bases
	(the 1st representation followed by the 2nd in parenthesis).

	BASE_CUSTOM allows one to specify a callback function pointer that will
	format the value. The function pointer of the same type as defined by
	custom_fmt_func_t in epan/proto.h, specifically:

	  void func(gchar *, guint32);
   
	The first argument is a pointer to a buffer of the ITEM_LABEL_LENGTH size
	and the second argument is the value to be formatted.