Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 44559: /trunk/epan/dissectors/ /trun

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Tue, 21 Aug 2012 14:26:28 -0400
mmann78@xxxxxxxxxxxx wrote:
I guess this makes #3 from http://www.wireshark.org/lists/wireshark-dev/201208/msg00164.html an unfortunate "yes". I guess I had the same idea you did - slowly

Yeah I noticed that after I sent the below email; I guess you can tell the order in which I read the mailing lists: -commits before -dev ;-).

replacing all g_ alloced memory in dissectors with se_ alloced memory where possible, and replace the rest of the g_ alloced memory with a new API (so g_ alloced APIs could be deprecated within dissectors). I've seen pe_ suggested, but I don't like it because its too easy to transpose to ep_ (and vice versa). I would suggest we_ for "Wireshark scoped". If #3 was "no" (because the possible extra memory was better than the possibility of hidden leaks), I could be more indiscriminate about the changes. Is there a dissector with a good fragmentation algorithm that doesn't use g_ alloced memory? Or were you refering to the "problem being solved" as being global (for all dissectors), or just SCTP?

Well, I think most dissectors use the epan/reassemble.c stuff which (IIRC/last I checked) uses g_malloc()'d memory and, like SCTP, does a copy when the reassembly is done. For a while I had dreams of using composite TVBs or something to avoid the copying, but I've since relented (or had at least forgotten about) that idea.

I don't remember why SCTP's reassembly was done without reassemble.c; assuming that the existing APIs didn't quite work for some reason, maybe SCTP's routines could be generalized and added to reassemble.c in order to push the g_malloc()'s out of the dissector.