Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] RFD: Limiting scope of ep_ memory

From: Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx>
Date: Mon, 22 Oct 2012 09:11:03 +0200
On Tue, Oct 16, 2012 at 03:18:32PM +0000, Anders Broman wrote:
> I think it sounds like the right thing to do and as no one have any objections I think you might as well go ahead and check it in :-)

Bug #7892.

Some solutions to fix it:

1/ revert r45673

2/ call epan_dissect_fill_in_columns() before ep_free_all()

  epan_dissect_fill_in_columns() in 8 cases of 9 is called after epan_dissect_run().

  Only complicated case is tshark, which pass edt pointer to print_packet(), which later not always call
  epan_dissect_fill_in_columns().

  Still it won't work, if GUI use ep_ allocated addresses.

3/ don't use ep_ memory for pinfo-> addresses?

   Greping for e.g. \<net_src\> in GTK+ code shows that it's used also to build conversation filters (ip, ethernet, ...)
   for these addr->data points to tvb (tvbs are freed in epan_dissect_cleanup()).

   I haven't (yet) found use of address with AT_STRINGZ data, but it can change anytime.