Wireshark · Ethereal-dev: Re: Patching aclocal was Re: [ethereal-dev] 0.8.4 this week

[Gilbert Ramirez <gram@xxxxxxxxxx>]

On Thu, Apr 06, 2000 at 01:10:50AM -0700, Guy Harris wrote:
> An unsafe recursive way is easy - you can just call the dissector from
> the ICMP dissector, although you then may want some way of having the
> internal IP packet's fields not show up as "ip.*" fields, although I
> think there are other encapsulation schemes with the same problem - and
> the only major safety problem is arranging that the IP dissector, *and*
> the dissectors called by it, not run past the end of the packet, but
> that's something that needs to be done *anyway*, so we can cope with
> captures with a snapshot length shorter than the MTU of the network on
> which the capture was taken.

This is one of my pet peeves. That is, the fact that so many dissectors,
including my own, don't check for end-of-packet. After my work on the
display filter stuff, what I'd like to do, even before the grand 1.0
release, is to implement an "exception" method (longjmp) for data access
in the frame data buffer.

A new "class" would contain the frame data buffer and the length. In
my drawings here at home I'm calling it a "testy buffer", since it
gets mad if you try to access bytes outside the buffer, and raises an
exception.

Also, you can chain the testy buffers so that a new child buffer sees only
part of its parent buffer. This new buffer is passed to the child
dissector. In this way, you can also get rid of the 'offset' arg of
each dissector, since each dissector starts dissecting from byte 0
of the tbuff (Testy Buffer) that it receives.

Ideas?

--gilbert