Wireshark-dev: [Wireshark-dev] Why tvb_get_bits() assumes Big Endian?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Tomasz Moń <desowin@xxxxxxxxx>
Date: Thu, 30 Jul 2020 08:06:07 +0200
Hello,

The tvb_get_bits() function family contains following comment:
    /* note that encoding has no meaning here, as the tvb is
considered to contain an octet array */

I don't understand the reason. What am I missing?

The actual octets in tvb contain the bits ordered as expected, so the
MSB/LSB-first problem within the octet itself does not apply (and I
think this is what the comment refers to). However, when the bit field
(e.g. 11 bits) spans across multiple octets, then the endianness does
matter (i.e. which of the two octets contains the more significant
part of the 11-bit value). Simply assuming Big Endian at the
cross-octet boundary prevents USB HID dissection from using
tvb_get_bits() directly because USB uses Little Endian.

Best Regards,
Tomasz Moń