I have been writing a new dissector where adjacent packets are grouped
according to some accumulative data.
To do so, I employed the p_add_proto_data() and p_get_proto_data() function
pair.
In short:
Crash when redissecting.
Important data: I do not pass pinfo->fd, rather I pass pinfo->fd->prev as
first parameter of p_get_proto_data()
More detailed explanation:
Every time the dissector is called it checks if a previous packet exists,
if it does then it gets my data structure that I have previously added.
Then, my dissector data structure is malloc'd, filled-in with data and
stored using p_add_proto_data().
When I re-dissect an input file (e.g. Decode As ...) I usually get a crash
that results from the following condition:
pinfo->fd is OK,
if (pinfo->fd->next)
next_packet = (my_packet *)p_get_proto_data(pinfo->fd->next,
proto_myproto);
This sometimes returns a corrupt pointer next_packet.
Any suggestion?
Thanks
Shaul
---------------------------------------------------------
Shaul Eizikovich
Escalation Engineer
Check Point Software Technologies Ltd. http://www.checkpoint.com
Tel: +972 - 3 - 753 4635
Fax: +972 - 3 - 753 4665
=========================================================================
This message may contain confidential and/or proprietary information, and is
intended only for the person / entity to whom it was originally addressed.
The content of this message may contain private views and opinions which do
not constitute a formal disclosure or commitment unless specifically stated.
