https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5790
--- Comment #7 from Chris Maynard <christopher.maynard@xxxxxxxxx> 2011-03-30 08:22:54 PDT ---
(In reply to comment #6)
> Hi, it is the right patch but i change also the unknown data dissect
>
> The part of code is fix the warning is :
>
> + if(offset < tvb_reported_length(tvb))
> + {
> + expert_add_info_format(pinfo, ti_len, PI_UNDECODED, PI_WARN, "
> Unknown Data (not interpreted)");
> +
Ah yes, of course. But this will cause the expert info warning to be attached
to the mongo message length field instead of to any unknown data at the end.
If you're going to add this, then I think it would be better to attach it to
the trailing unknown data, no?
Also, in the case when the opcode falls through to the default case, you set
the offset to the tvb_reported_length(), so in this case there's definitely
unknown data, but the expert info warning won't be added. I don't think that
is what we want, is it?
BTW, the comment I made on wireshark-dev about converting to a new-style
dissector was meant more for, "in general", and not specifically to mongo. I
hadn't actually looked at the mongo dissector code at the time. But I think
you're right, tcp_dissect_pdus() does present a problem, because it wouldn't
properly handle a new-style dissector that returns the number of bytes
dissected.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.