Wireshark · Wireshark-dev: Re: [Wireshark-dev] RFD: Limiting scope of ep_ memory

[Evan Huus <eapache@xxxxxxxxx>]

On Mon, Oct 22, 2012 at 3:11 AM, Jakub Zawadzki
<darkjames-ws@xxxxxxxxxxxx> wrote:
> On Tue, Oct 16, 2012 at 03:18:32PM +0000, Anders Broman wrote:
>> I think it sounds like the right thing to do and as no one have any objections I think you might as well go ahead and check it in :-)
>
> Bug #7892.
>
> Some solutions to fix it:
>
> 1/ revert r45673
>
> 2/ call epan_dissect_fill_in_columns() before ep_free_all()
>
>   epan_dissect_fill_in_columns() in 8 cases of 9 is called after epan_dissect_run().
>
>   Only complicated case is tshark, which pass edt pointer to print_packet(), which later not always call
>   epan_dissect_fill_in_columns().
>
>   Still it won't work, if GUI use ep_ allocated addresses.
>
> 3/ don't use ep_ memory for pinfo-> addresses?
>
>    Greping for e.g. \<net_src\> in GTK+ code shows that it's used also to build conversation filters (ip, ethernet, ...)
>    for these addr->data points to tvb (tvbs are freed in epan_dissect_cleanup()).
>
>    I haven't (yet) found use of address with AT_STRINGZ data, but it can change anytime.

Perhaps ep_free_all() should be called in epan_dissect_cleanup() and
epan_dissect_reset() instead of at the end of epan_dissect_run()? I
think that would delay freeing the memory enough, while still leaving
it conceptually after each packet instead of before the next...

Tangentially, epan_dissect_cleanup() and epan_dissect_reset() share
some code that should probably be abstracted into its own function.

Evan