Wireshark-dev: [Wireshark-dev] Is "tcp.len < -1" a valid display filter?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stig Bjørlykke <stig@xxxxxxxxxxxxx>
Date: Thu, 27 Oct 2011 08:28:43 +0200
Hi.

On a 32-bit system the display filter "tcp.len < -1" seems to be
valid, and does return all TCP packets.

This happens because we use strtoul() to convert the string "-1" to a
unsigned long, and the documentation states that "the string is
converted to an unsigned long value in the obvious manner".  I suppose
this means that the value is casted from signed to unsigned without a
warning.

The attached patch fixes this, but can we do this check in a simpler manner?


-- 
Stig Bjørlykke

Attachment: signed-unsigned-integer.patch
Description: Binary data