Home page logo

wireshark logo Wireshark mailing list archives

Bug in expert_add_info_format with a NULL pi parameter
From: Peter Wu <peter () lekensteyn nl>
Date: Sat, 19 Jul 2014 00:33:26 +0200


While working on refactoring the SSL dissector[1], I noticed that
expert_add_info_format(pinfo, NULL, ...) does not add an expert item to the
tree view. In the case of the SSL dissector, the NULL should be replaced by 
the proto item to which the message is related, but with pi = NULL, an item 
should still be added somewhere, right? See attached capture. It should add
an expert warning with "Cipher suite length (1) must be a multiple of 2".
Note that in the current implementation, a text label is also added.

This is probably a bug, but the documentation says this:

/** Add an expert info.
 Add an expert info tree to a protocol item, using registered expert info 
 but with a formatted message.
 @param pinfo Packet info of the currently processed packet. May be NULL if
        pi is supplied
 @param pi Current protocol item (or NULL)
 @param eiindex The registered expert info item
 @param format Printf-style format string for additional arguments
expert_add_info_format(packet_info *pinfo, proto_item *pi, expert_field 
        const char *format, ...) G_GNUC_PRINTF(4, 5);

I have confirmed (via a gdb breakpoint) that pinfo is never NULL. Any idea
what is going on here?

Kind regards,

 [1]: https://code.wireshark.org/review/3021/

Attachment: bad.pcapng

Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]