Wireshark-dev: Re: [Wireshark-dev] proto_tree_add_item() calls where length doesn't match type
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 16 Oct 2020 15:14:46 -0700
On Oct 16, 2020, at 2:54 PM, Martin Mathieson <martin.r.mathieson@xxxxxxxxxxxxxx> wrote:

> There might be some protocols where there was (say) a 7 byte integer field, so the dissector writer had to round it up to the nearest supported size, but again I didn't see that.

That's because the nearest supported size is FT_{U}INT56, so no rounding up would have been necessary unless there was a time after we introduced FT_{U}INT64 but before we introduced FT_{U}INT{40,48,56}.

> Another clue is the amount by which 'offset' might be added to in the very next line (i.e. which size does it match?), but that would be hard to reliably parse.

Sadly, C is far from being a good packet description language.