Wireshark · Wireshark-dev: Re: [Wireshark-dev] Why tvb_get_bits() assumes Big Endian?

[Tomasz Moń <desowin@xxxxxxxxx>]

On Thu, Jul 30, 2020 at 8:58 AM Tomasz Moń <desowin@xxxxxxxxx> wrote:
>
> On Thu, Jul 30, 2020 at 8:30 AM Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:
> > Let’s put a hypothetical here, a 7 bit value spanning 2 octets:
> >
> >  15 14 13 12 11 10  9  8| 7  6  5  4  3  2  1  0
> > +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
> > |  |  |  |  |  |  | 6| 5| 4| 3| 2| 1| 0|  |  |  |
> > +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
> >
> > This would be the typical interpretation, as seen in network protocols.
> >
> > Your suggestion is that the interpretation can also be:
> >
> >  15 14 13 12 11 10  9  8| 7  6  5  4  3  2  1  0
> > +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
> > |  |  |  |  |  |  | 1| 0| 6| 5| 4| 3| 2|  |  |  |
> > +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>
> This is not what I wanted to write. Assuming you meant two octets, and
> the bitmask on the 16-bit value is 0x1FC0 then the alternative
> interpretation would be:
>   15 14 13 12 11 10  9  8| 7  6  5  4  3  2  1  0
>  +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
>  |  |  |  |  |  |  | 4| 3| 2| 1| 0| 6| 5|  |  |  |
>  +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

Sorry, I should have displayed that in a fixed font earlier! It is
perfectly clear then (the bitmask in your example is 0x03F8, and not
0x1FC0 as I was led to believe due to trying to figure it out on font
not suited for the task)