[Guy Harris <gharris@xxxxxxxxx>]

On Thu, Jun 12, 2003 at 03:48:06PM +1000, Fullager, Glenn wrote:
> I try 
> 
>     frame[46-4d] == 8:4:1:2:6:8:5:2 and udp.length > 30
> 
> which usually results in Ethereal crashing with an assertion error.

That's because:

	1) by default, offsets in filter expressions are *decimal*, not
	   *hexadecimal*;

	2) the lexical analyzer didn't catch the extra "d" character in
	   "4d", it just returned a value of "4";

	3) Ethereal didn't check for ranges where the ending offset was
	   less than the starting offset, and that caused a crash.

I've checked in a fix for problem 3) (but have to check in another fix
to allow the starting and ending offsets to be equal).

I'll look at doing something about 2).

You have to do something about 1), namely trying

	frame[0x46-0x4d] == 8:4:1:2:6:8:5:2 and udp.length > 30

to see if *that* works.