ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] proto_tree_add_item() calls where length doesn't match type

From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 16 Oct 2020 15:14:46 -0700
On Oct 16, 2020, at 2:54 PM, Martin Mathieson <martin.r.mathieson@xxxxxxxxxxxxxx> wrote:

> There might be some protocols where there was (say) a 7 byte integer field, so the dissector writer had to round it up to the nearest supported size, but again I didn't see that.

That's because the nearest supported size is FT_{U}INT56, so no rounding up would have been necessary unless there was a time after we introduced FT_{U}INT64 but before we introduced FT_{U}INT{40,48,56}.

> Another clue is the amount by which 'offset' might be added to in the very next line (i.e. which size does it match?), but that would be hard to reliably parse.

Sadly, C is far from being a good packet description language.