Wireshark · Wireshark-dev: [Wireshark-dev] basic questions about writing dissectors

[Martin Kaiser <lists@xxxxxxxxx>]

Dear all,

I'm playing with some enhancements to my dissectors, some basic
questions came up:

Is it possible to add an element in the packet tree that has an hf entry
and can be filtered but does not have a corresponding tvb? I'm looking
at getting info from a circuit and add this to the tree as a filterable
element. For now, I read from the circuit, create a tvb, add another
data source for the tvb and dissect it. I was wondering if there's a
cleaner solution without adding a data source. (It looks like a tvb
that's not part of the packet itself needs a new data source).

It seems that a lot of dissectors use pinfo->fd->num without a previous
check "if (pinfo && pinfo->fd)". Is it safe to do so?

For se_malloc(), do I have to check the return value for NULL? I recall
that for g_malloc(), there's no need for a NULL check, the programs is
terminated when there's no memory.

Thanks in advance for your help,

   Martin