Wireshark · Wireshark-users: [Wireshark-users] Truncated field in XML detailed export result

["Olivier LENORMAND" <Olivier.Lenormand@xxxxxxxxxxx>]

Hi,

I came across what seems to be a bug when exporting a WS capture session
to an XML file (PDML, aka a detailed XML file).

Here is an extract of the xml file enlighting the problem (this is the
DATA section of an HTTP POST request for curious people :)):

 <proto name="data-text-lines" showname="Line-based text data:
application/x-www-form-urlencoded" size="641" pos="1735">
    <field
show="%7EMenuitem=&amp;%7EFocusfield=@%24@OBJ00001%5B1%5D&amp;%7EOkCode=
%2F0&amp;%7EFKey=4&amp;%7ESearchhelp=&amp;%7EControl=&amp;%7EEvent=&amp;
%7EEventParameter=&amp;%7EwebguiUserAreaHeight=717&amp;%7EwebguiUserArea
Width=1094&amp;%7EwebguiRenderTime=234&amp;%7EwebguiRequestTime=0&amp;%7
Ewebg" size="641" pos="1735"
value="2537454d656e756974656d3d26253745466f6375736669656c643d40253234404
f424a303030303125354231253544262537454f6b436f64653d2532463026253745464b6
5793d342625374553656172636868656c703d26253745436f6e74726f6c3d26253745457
6656e743d262537454576656e74506172616d657465723d2625374577656267756955736
572417265614865696768743d37313726253745776562677569557365724172656157696
474683d313039342625374577656267756952656e64657254696d653d323334262537457
765626775695265717565737454696d653d3026253745776562677569537461727452657
17565737454696d653d31313632393136333330383536262537457072696e74646174615
f636c6f73653d262537457765626775694d6f64616c506978656c4c6566743d262537457
765626775694d6f64616c506978656c546f703d262537457765626775695f747970655f6
4796e70726f646174613d262537457765626775695f6d6f64616c77696e646f773d26253
7457765626775695f637572736f726f626a3d262537457765626775695f637572736f726
36f6c3d262537456374786d656e75726571756573743d262537456374786d656e7573656
c65637465643d2625374577656267756957696e646f774865696768743d2625374577656
267756957696e646f7757696474683d26253745546f6f6c6261724f6b436f64655669736
9626c653d2625374577656267756944796e70726f4d65747269633d312640253234404f4
24a3030303031253542312535443d2640253234404f424a3030303033253542312535443
d2664796e70726f7363726f6c6c783d302664796e70726f7363726f6c6c793d30"/>
  </proto>

As you can see, though the "size" field is correct (regarding the length
of the "value" field), the "show" field is too small and only shows the
first 287 chars.

When ASCII-zed, the "value" field is

%7EMenuitem=&%7EFocusfield=@%24@OBJ00001%5B1%5D&%7EOkCode=%2F0&%7EFKey=4
&%7ESearchhelp=&%7EControl=&%7EEvent=&%7EEventParameter=&%7EwebguiUserAr
eaHeight=717&%7EwebguiUserAreaWidth=1094&%7EwebguiRenderTime=234&%7Ewebg
uiRequestTime=0&%7EwebguiStartRequestTime=1162916330856&%7Eprintdata_clo
se=&%7EwebguiModalPixelLeft=&%7EwebguiModalPixelTop=&%7Ewebgui_type_dynp
rodata=&%7Ewebgui_modalwindow=&%7Ewebgui_cursorobj=&%7Ewebgui_cursorcol=
&%7Ectxmenurequest=&%7Ectxmenuselected=&%7EwebguiWindowHeight=&%7Ewebgui
WindowWidth=&%7EToolbarOkCodeVisible=&%7EwebguiDynproMetric=1&@%24@OBJ00
001%5B1%5D=&@%24@OBJ00003%5B1%5D=&dynproscrollx=0&dynproscrolly=0

And that's what the "show" field is supposed to store, am I wrong?

This occurs with WS 99-4, and the latest nightly build (19868).
I can't tell if it was working before 99-4, because 99-3 failed to
export detailed XML files.

Btw, no all "data-text-lines"'s "show" fields seem to be trucated, but
because of the huge size of my XML file, I haven't checked all them
manually :)

If I did not misunderstood the meaning of the "show" field (seems quite
obvious to me), is there any chance that the XML-export guru will fix
this bug in the next nightlies?

Thanks in advance, Olivier.