Wireshark · Ethereal-dev: Re: [ethereal-dev] cvs commit: ethereal packet-aarp.c

[Guy Harris <gharris@xxxxxxxxxxxx>]

> There is no need to add such a test for each field since testing 
> the presence of the whole header seems to be sufficient (except if we
> want to decode the fields at the beginning of an incomplete header) ?

We might want to do that.

> But there are some cases where the check is not so trivial (decoding of 
> non '\0' terminated strings

If it's not '\0'-terminated, it may be counted, in which case one would
presumably be handing the length of the field to the
"proto_tree_add_...()" routine, and it could do that check.

> or of fields which size depends on a previous decoded field

...in which case you'd again presumably be handing it the size that
you've derived from that field (counted strings are one example of
this).

> or worst on the data itself for instance),

...such as a '\0'-terminated string.