Ethereal-users: Re: [Ethereal-users] Error

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Fri, 5 Nov 2004 18:48:55 -0800 (PST)
Maneet Jodhka said:
> Need Assitance with  error message shown below. I am running Ethereal 10.7
> with winpcap 3.0. I have had same issue with Ethereal 10.5a and winpcap
> 3.0.  I am on win 2000 with Service pack 4.
>
> GLib-Error **:file gdate.c: line 850 (g_date_set_time):assertion
> failed:ptm (aborting)
>
> I get this message when trying to open a file or when trying to save a
> capture.

This is probably a bug in GLib.  At least in the GLib 2.4.0 source I have,
that line is

    g_assert (ptm);

right after

    struct tm *ptm = localtime (&t);

so the error is probably coming from "localtime()" returning a null pointer.

To quote the MSDN documentation for "localtime()":

    Return a pointer to the structure result. If the value in timer
represents a date before midnight, January 1, 1970, return NULL.

There's probably a file in the directory in which you're trying to open or
save the file with a modification date before midnight GMT, January 1,
1970.  Unfortunately, the GLib library, which is used by the GTK+ GUI
library (the library Ethereal uses for its GUI), has a routine that
doesn't handle that in a reasonable fashion on Windows - on UN*X, negative
values passed to "localtime()" are handled as dates before midnight GMT,
January 1, 1970.

So this is a GLib bug (it should try to do *something* if "localtime()"
returns a null pointer, even if it just says "midnight, January 1, 1970"
for the date and time).  I don't know whether that bug is fixed yet in any
versions of GLib (or if it's even been filed as a GLib bug).

Unfortunately, there's no workaround - and no fix short of using a version
of Ethereal that doesn't use GTK+ (GLib itself doesn't use
"g_date_set_time()" for anything, and neither does Ethereal).  A version
using the native Windows GUI code is under development, but I don't know
whether it's ready for general use yet.

Well, actually, there is one workaround, although it's a pretty radical one:

> Basically, I can't use the software. I have tried un-installing
> and re-installing  the software. Did same with Winpcap.

...un-install the OS and install Linux or one of the BSDs or Solaris or
some other flavor of UN*X supported by Ethereal.  Their "localtime()"s are
a bit more permissive.