On 04/18/13 15:14, Evan Huus wrote:
This is a tangential issue that has always confused me.
Why do we malloc+memcpy data for reassembly when we already have
'virtual' composite TVBs?
Wouldn't it be more efficient (in time and memory) to create a
composite TVB for each reassembly and then build the reassembled
packet in it? You would never have to copy or allocate any actual
packet data...
There are a couple of problems with doing that (that I recall):
1) Composite TVBs don't actually work (or didn't work until very recently?).
2) The data behind a TVB goes away as soon as we're done dissecting (and
displaying) the packet. That is, the TVB data is overwritten (IIRC)
when the next packet is read.
I suppose there was never any real reason to try to make reassembly work
with composite TVBs: if they're just more malloc()'d memory then why
mess with it rather than allocate our own copy of the data? (Well, OK,
it would save a data copy, but...)