Wireshark-dev: Re: [Wireshark-dev] Familiar with gtk/sctp_graph_dlg.c?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 26 Apr 2011 10:03:02 -0700
On Apr 26, 2011, at 1:12 AM, Michael Tüxen wrote:

> The fields in the packet are 4 byte aligned. But if the whole structure might not...
> So should we copy them?

...or fetch them with pntohl().

Where are the contents of the structure coming from?  If they're coming from the raw packet data - i.e., if the pointer in question is pointing into the raw packet data from the tvbuff handed to the SCTP dissector - then not only might the data not be aligned on a 4-byte boundary, it might not even contain all the data you're looking at if the packet was cut short by a snapshot length.