[Guy Harris <guy@xxxxxxxxxxxx>]

On Feb 11, 2004, at 1:27 PM, Guy Harris wrote:

> BTW, the filter expression
>
> 	"what the heck
>
> *without* a closing quote is considered syntactically legal, and the 
> resulting filter doesn't appear to reject any packets.  The phrase 
> that comes to mind is, well, "what the heck?".

There were two problems:

	1) the scanner wasn't handling end-of-input while in the "processing a 
double-quoted string" state, so it was just returning an end-of-input 
indication - I added a rule to handle that by calling "dfilter_fail()" 
to report the problem and then returning SCAN_FAILED, but

	2) SCAN_FAILED was 0, so it was indistinguishable from end-of-input, 
so *all* the cases where we were returning SCAN_FAILED weren't being 
handled as errors - I changed SCAN_FAILED to -1 and made 
"dfilter_compile()" check for a return value of SCAN_FAILED and fail if 
it sees it.

That also means that a filter with a string of "\777" is now reported 
as an error, as was intended.