ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Replace TRUE/FALSE with proper ENC_* in proto_tree_add_item(

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Tue, 04 Oct 2011 16:08:22 -0400
Dirk Jagdmann wrote:
I propose to use a perl script to automate as much as reasonable the
replacement of TRUE/FALSE in the encoding parameter of the
proto_tree_add_item() calls in dissectors as follows:

sounds good, but may be difficult to write. Because you would need to write a parser for C function calls in perl. regular expressions won't do the trick, as they can not reliably match parenthesi. Also keep in mind that those proto_tree_*() functions can use multiple lines. But just doing regular expression may give you 90% of the cases which would be good enough.

I had a fair amount of luck with the (currently not run) checkAPIsCalledWithTvbGetPtr() function in checkAPIs.pl . It definitely is not 100%, but it served my purposes well. It avoids dealing with parenthesis by assuming the only semi-colon it will find is the end of the function call ;-).

I imagine regexp'ing for

proto_tree_add_item[^;]*[TRUE|FALSE]\s*\)\s*;

would be sufficient to find offenders.