Wireshark · Wireshark-dev: Re: [Wireshark-dev] FW: DISSECTOR_ASSERT_NOT_REACHED in WLCCP decode...

[Guy Harris <guy@xxxxxxxxxxxx>]

Kevin A. Noll wrote:

> I'll make that change, but can you point me to an explanation of the
> difference between these two? I'm sure it's something to do with unsigned
> versus signed,

No.

FT_UINT_BYTES means "a counted sequence of bytes" - i.e., a 1-byte to 
4-byte number, followed by that number of bytes.  If there's no count 
field, FT_UINT_BYTES shouldn't be used.

For a sequence of bytes *not* preceded by a length value giving the 
number of bytes in the sequence - or for a sequence of bytes where the 
length value is to be treated as a separate field - FT_BYTES should be used.

The unsignedness of the bytes is implicit, as, for opaque sequences of 
bytes, most if not all of the time you just want to display their hex 
values, with the uppermost bit being just another bit.  The UINT in 
FT_UINT_BYTES doesn't mean "the bytes are unsigned integers"; it means 
"the sequence is preceded by an unsigned integer giving the number of 
bytes in the sequence.

Unfortunately, FT_UINT_BYTES isn't documented in README.developer.  This 
is a bug, and I'll look at fixing it.