ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Sign extension bug in proto_tree_set_uint64?

From: "Kilian, Jens" <jens.kilian@xxxxxxxxxxxxx>
Date: Mon, 6 Jun 2016 14:02:34 +0000
Hi all,
I'm trying to define some header fields of type FT_UINT64 which have non-zero bitmasks (they all sit inside the same 64-bit word).  These fields are sign extended when displayed, which is not what I expected.  The sign extension happens in epan/proto.c, function proto_tree_set_uint64().

Comparing the 32-bit and 64-bit, and signed/unsigned variants of this function, it seems to me that this is a bug, possibly caused by forgetting to remove the sign extension code when proto_tree_set_int64 was added in commit e2bcee6a.  Am I right, or is this behavior intended?

Thanks,

	Jens.