Skip to content
  • João Valverde's avatar
    dfilter: Fix protocol slices with negative indexes · 51de43cf
    João Valverde authored
    Field infos have a length property that was not stored with the
    field value so when using a negative index the end was computed
    from the captured length of the frame tvbuff, leading to incorrect
    results. The documentation in wireshark-filter(5) describes how
    this was supposed to work but as far as I can tell it never worked
    properly.
    
    We now store the length and use that (when it is different from -1)
    to locate the end of the protocol data in the tvbuff. An extra wrinkle
    is that sometimes the length is set after the field value is created.
    This is the most common case as the majority of protocols have a
    variable length and dissection generally proceeds with a TVB subset from
    the current layer (with offset zero) through all remaining layers to the
    end of the captured length. For that reason we must use an expedient to allow
    changing the protocol length of an existing protocol fvalue, whenever
    proto_item_set_len() is called.
    
    Fixes #17772.
    51de43cf