Wireshark · Ethereal-dev: Re: [ethereal-dev] packet-icq.c ICQ dissector

[Kojak <kojak@xxxxxxxxxx>]

> > I built an icq dissector, just to see if it was easy. And, yes it
> > is. Maybe you can add this to the tree, or you can just throw it away.
> I chose the first of those two alternatives.

Thanx :-)
 
> > time when I (or someone else) has an idea how to handle a
> > zero-terminated string somewhere in the middle of a
> > structure... <Sigh>
> I.e., the structure has something like
> 
> 	fixed-length field A
> 	fixed-length field B
> 	variable-length '\0'-terminated string
> 	fixed-length field D
> 
> in it?

Yes, exactly. And it happens a lot in the code.
 
> If so, I'd be inclined to extract A and B, update the offset into the
> packet to point to the first byte of the string, scan forward in the
> packet for the '\0' (making sure that you don't run off the end of the
> captured data in the packet), update the offset to refer to the first
> byte after the '\0', and extract D from that offset.

Ok, I'll stick to this convention. I like overlaying structures better,
but this makes more sense in an environment where you don't know anything
for sure about the packet.

--
Kojak