Wireshark 4.0 breaks display filter expression with > sign
Summary
Before version 4.0 the following display filter would work:
icmp and ((icmp.type > 0 and icmp.type < 8) or icmp.type > 8)
Now this filter is marked red.
Using any other operator it works.
icmp and ((icmp.type > 0 and icmp.type < 8) or icmp.type gt 8)
It seems to me that something is broken in the syntax parsing that doesn't like the greater than.
BTW: I encountered this issue while trying to rewrite this filter for version 4.0 to something like:
icmp.type#1!=8 and icmp.type#1!=0
Steps to reproduce
Use the filter icmp and ((icmp.type > 0 and icmp.type < 8) or icmp.type > 8)
What is the current bug behavior?
Wireshark shows a syntax error
What is the expected correct behavior?
Wireshark should allow this syntax
Build information
TShark (Wireshark) 4.0.0 (v4.0.0-0-g0cbe09cd796b).
Copyright 1998-2022 Gerald Combs <gerald@wireshark.org> and contributors.
Licensed under the terms of the GNU General Public License (version 2 or later).
This is free software; see the file named COPYING in the distribution. There is
NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) using Clang 13.0.0 (clang-1300.0.29.30), with GLib 2.68.4,
with PCRE2, with zlib 1.2.11, with libpcap, without POSIX capabilities, with Lua
5.2.4, with GnuTLS 3.6.15 and PKCS #11 support, with Gcrypt 1.8.7, with Kerberos
(MIT), with MaxMind, with nghttp2 1.46.0, with brotli, with LZ4, with Zstandard,
with Snappy, with libxml2 2.9.9, with libsmi 0.4.8, with binary plugins.
Running on macOS 12.6, build 21G115 (Darwin 21.6.0), with Apple M1 Pro, with
16384 MB of physical memory, with GLib 2.68.4, with PCRE2 10.39 2021-10-29, with
zlib 1.2.11, with libpcap 1.9.1, with c-ares 1.15.0, with GnuTLS 3.6.15, with
Gcrypt 1.8.7, with nghttp2 1.46.0, with brotli 1.0.9, with LZ4 1.9.2, with
Zstandard 1.4.2, with libsmi 0.4.8, with LC_TYPE=UTF-8, binary plugins
supported.