[Graeme Hewson <ghewson@xxxxxxxxxxxxxxxxxxx>]

Jon Oberheide wrote:
> Oliver,
>
> Looks to be related to this patch
> http://www.ethereal.com/cgi-bin/viewcvs.cgi/ethereal/epan/dfilter/semcheck.c.diff?r1=1.25&r2=1.26
>
> Removing the LHS check code causes 'ip and udp contains "x"' to work
> properly again.  However, that comment above it seems to have a valid
> point so maybe it needs to be implemented differently.  Unfortunately,
> I've never even looked at the display filtering before and don't have
> time to get into it right now.
>
> Regards,
> Jon Oberheide
> jon@xxxxxxxxxxxxx

The problem seems to be higher up in the calling sequence.  When 
check_relation() decides there's a protocol on the RHS, what is "sees" is
"udp contains ip" and the gdb backtrace shows:

#0  check_relation (relation_string=0x868d1ea "contains",
    allow_partial_value=1, can_func=0x81cbf64 <ftype_can_contains>,
    st_node=0x8c41a80, st_arg1=0x8bb1630, st_arg2=0x8c41a68) at semcheck.c:740
#1  0x081ca9de in check_test (st_node=0x8c41a80) at semcheck.c:826
#2  0x081caad5 in semcheck (st_node=0x8c41a80) at semcheck.c:856
#3  0x081ca8c8 in check_test (st_node=0x8bab338) at semcheck.c:801
#4  0x081caad5 in semcheck (st_node=0x8bab338) at semcheck.c:856
#5  0x081ca8bc in check_test (st_node=0x8bd4cd8) at semcheck.c:800
#6  0x081caad5 in semcheck (st_node=0x8bd4cd8) at semcheck.c:856
#7  0x081cabee in dfw_semcheck (dfw=0x8c981a8) at semcheck.c:879
#8  0x081c5fe9 in dfilter_compile (text=0x8c98188 "ip and udp contains \"x\"",
    dfp=0xbfffed68) at dfilter.c:249
#9  0x08058741 in filter_te_syntax_check_cb (w=0x8be02b0)
    at filter_prefs.c:1361


Graeme Hewson