[Guy Harris <guy@xxxxxxxxxx>]

> It all cleaned up well, except for one case in which a dissector
> *does* modify the tvbuff data. packet-ieee80211.c, line 600:
> 
>       for (i = 0; i < tag_len; i++)
>         {
> 
>           if (tag_data_ptr[i] >= 128)
>             {
>               tag_data_ptr[i] -= 128;       /************* BAD!
> **************/
>               n += snprintf (out_buff + n, SHORT_STR - n, "%2.1f ",
> (float)
>                              (((float) tag_data_ptr[i]) * 0.5));
>             }
> 
>           else
>             n += snprintf (out_buff + n, SHORT_STR - n, "%2.1f ",
> (float)
>                            (((float) tag_data_ptr[i]) * 0.5));
> 
>         }

If that code correctly handles that part of IEEE 802.11, then
"tag_data_ptr[i]" is a 7-bit number, giving the supported rate in units
of 1/2Mbit/sec, plus an 8th bit at the top, which the dissector doesn't
dissect.  ("if (x >= 128) x -= 128" is equivalent to "x &= 0x7F" if "x"
fits in one byte, as is the case there.)

If so, then

	n += snprintf (out_buff + n, SHORT_STR - n, "%2.1f ",
		       (tag_data_ptr[i] & 0x7F) * 0.5);

would suffice (you don't even need one cast to "float", much less
two...).

If not, then the code needs to be fixed to correctly dissect a
"Supported Rates" tag.

I have 802.11 and 802.11b at home; I'll give a look at that.