Display filter slices with negative indexes do not work
Summary
Using a negative slice index is documented and accepted as valid syntax but produces incorrect (semi-random) results.
Steps to reproduce
Run the filter: run/tshark -r ../test/captures/dhcp.pcap -Y 'udp[-1] == 0xDB'
What is the current bug behavior?
Does not match any frames. Should match frame 4 of the test capture.
Analysis
Wireshark store protocol field types backed as TVBuffs. There are not set to the correct protocol length but run to the end of the captured length.
Therefore the index from the end is calculated from the end of the captured length, which is wrong.
Likewise protocol equality with byte arrays in filter expressions does not work, for the same reasons.
An extra difficulty is than many protocols add a TVbuff with length -1 and only set the correct length (for the protocol tree) after creating the protocol tree node.