("Unused" includes "set but not used".)
Change-Id: Id67859b366e8caa50262f8530630ec4e8ef1507a
Reviewed-on: https://code.wireshark.org/review/12457
Reviewed-by: Guy Harris <guy@alum.mit.edu>
This reverts commit b56f53884b.
Sadly, we *do* get warnings at this point with older versions of Flex,
such as the one on the 32-bit OS X buildbot.
Change-Id: I9aec1a16e9f2e1bbcfaac3dffdabdd89af5815e3
Reviewed-on: https://code.wireshark.org/review/12443
Reviewed-by: Guy Harris <guy@alum.mit.edu>
We shouldn't be getting warnings at this point.
Change-Id: I363a48546cb8d916425f42962ae1697d52ed9a29
Reviewed-on: https://code.wireshark.org/review/12436
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Tweak lemonflex-tail.inc to fix an issue this reveals.
It appears that, at least on the buildbots, the Visual Studio compiler
no longer issues warnings for the code generated with %option noyywrap.
Change-Id: Id64d56f1ae8a79d0336488a4a50518da1f511497
Reviewed-on: https://code.wireshark.org/review/12433
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Bug: 11820
Change-Id: I7e0a603c20ca0c524399beb3d89e14c45dc3a06e
Reviewed-on: https://code.wireshark.org/review/12393
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
As the comment says, that routine "[ensures] there is a valid bitrate",
and a bitrate of 0, which comes from truncating a fractional bitrate, is
not a valid bitrate (an MPEG-2 Transport Stream with a bitrate less than
1 bit per second is not going to carrry any sensible audio/video
stream).
Make the "first" argument unsigned; it can never be negative.
Restructure the code and change some data types to make it more obvious
that it can't.
Change-Id: Idd4d073dc558bb31271318e14b2f74292cd16a2b
Reviewed-on: https://code.wireshark.org/review/12352
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Bug: 11821
Change-Id: I3243c837d84ccbce7d377810a5f381e906aeb1eb
Reviewed-on: https://code.wireshark.org/review/12323
Reviewed-by: Michael Mann <mmann78@netscape.net>
Change-Id: Ia2ce54592485d2995bcfd56bd127a2fedb1a7d07
Reviewed-on: https://code.wireshark.org/review/12293
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Handle Date: outside the "loop over magic strings" loop; that way, we
don't have to compare against "Date:" twice.
Don't use strlen() on constant strings - sizeof string - 1 lets us
calculate the length at compile time.
Change-Id: I7e4ff2f9762f96749a39609efa76430e5915d4f4
Reviewed-on: https://code.wireshark.org/review/12302
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Bug: 11794
Change-Id: I74517806b119729ae6d9780bbd4bb094701ff05e
Reviewed-on: https://code.wireshark.org/review/12266
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Bug: 11791
Change-Id: Ibaa2c16229c1b78818283ba5f954b09f3894dc60
Reviewed-on: https://code.wireshark.org/review/12270
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
No need to put them on the stack and initialize them at the beginning of
the routine.
Change-Id: Id6332be186660c881cf37290f70d03cc77ac66be
Reviewed-on: https://code.wireshark.org/review/12265
Reviewed-by: Guy Harris <guy@alum.mit.edu>
For unsigned x, x/8 is x >> 3, and x*8 is x << 3, so 8*(x/8) is the result
of shifting x right 3 bits and then left 3 bits, which is the same as
masking out the low-order 3 bits, and x - (8*x/8) is the result of
subtracting all but the low-order 3 bits from x, thus it's the lower 3
bits, so you can just mask it with 0x7. That means the result is in the
range 0 through 7, so as long as the array has 8 elements, you're OK; it
does, but explicitly declare it as such, to make it clearer that it is,
and to get compiler warnings if not all 8 elements are initialized.
Change-Id: Iff9c0626b9bdc012cca52e4160dda9e947315bc4
Reviewed-on: https://code.wireshark.org/review/12264
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Bug: 11789
Change-Id: Ieba9f32928b91be5d07b25bf54005155f7cc79f6
Reviewed-on: https://code.wireshark.org/review/12245
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
wtap.c:74:25: warning: ISO C forbids conversion of object pointer
to function pointer type [-Wpedantic]
Choose ISO C or dynamic loading, can't have both.
Change-Id: I6d48073dadaf7c1710bd87ed71a2e7b65970d47e
Reviewed-on: https://code.wireshark.org/review/12165
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
pcapng.c:461:31: warning: ISO C forbids passing argument 3 of 'g_hash_table_insert' between function pointer and 'void *' [-Wpedantic]
pcapng.c:1404:32: warning: ISO C forbids conversion of object pointer to function pointer type [-Wpedantic]
pcapng.c:1918:32: warning: ISO C forbids conversion of object pointer to function pointer type [-Wpedantic]
Change-Id: I535633098cc5d37442732dd92e8c9d3cda36631a
Reviewed-on: https://code.wireshark.org/review/12161
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Fixes warning:
nettrace_3gpp_32_423.c:813:4: warning: format '%u' expects argument
of type 'unsigned int *', but argument 3 has type 'int *' [-Wformat=]
Change-Id: I4bfcc19ecac115d5aa2e222dfed8ea8b0b450d71
Reviewed-on: https://code.wireshark.org/review/12211
Reviewed-by: Guy Harris <guy@alum.mit.edu>
when we check for an mpeg2 transport stream, we're trying to detect an
initial offset before the first sync byte and the length of additional
data appended to each packet
use those values when we go through the file again and verify the PCR
Bug: 11749
Change-Id: Iab03cb271d23d38f850ca857b64ca47ba4501175
Reviewed-on: https://code.wireshark.org/review/12183
Reviewed-by: Michael Mann <mmann78@netscape.net>
Process it in libwiretap; no need to hand it to libwireshark for
dissection, it can just dissect the radio information pseudo-header with
the processed information.
Change-Id: I482697947eecbd3967cf1910ba2fa2bff805cd66
Reviewed-on: https://code.wireshark.org/review/12202
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Also, fix the month check ("month" is in the range 1 through 12, not 0
through 11), and if neither sscanf() gets the right number of fields,
fail immediately.
Change-Id: I3f0da49e969c020c292facb843b9741116647302
Reviewed-on: https://code.wireshark.org/review/12170
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Add some bounds checks while we're at it.
Change-Id: I19804aee10496fd68f95a27865f8f455d3abbe9f
Reviewed-on: https://code.wireshark.org/review/12166
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Thanks and a tip of the Hatlo hat to Coverity for finding this.
Change-Id: Ie9d4089443e52ef427e0cc8ae6e90a9d9787134e
Reviewed-on: https://code.wireshark.org/review/12123
Reviewed-by: Guy Harris <guy@alum.mit.edu>
add DLT_ISO14443 to pcap_to_wtap_map[]
define WTAP_ENCAP_ISO14443, link it to the iso14443 dissector
Change-Id: Id837197c4d66071094f9336d60db36a371424807
Reviewed-on: https://code.wireshark.org/review/11959
Petri-Dish: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Caught by cppcheck. The buffer is 9+1 characters, which means we should specify
9, not 10 to the scanf string since the count does not include the
null-terminator.
Change-Id: I0aae8cce337055b304efa9399cd5d8059928d2d8
Reviewed-on: https://code.wireshark.org/review/11887
Reviewed-by: Evan Huus <eapache@gmail.com>
It includes the temporary-file generation, so you don't have to do it
yourself.
Change-Id: I0798df95a5c5646224ec49612f50b423ed78547a
Reviewed-on: https://code.wireshark.org/review/11751
Reviewed-by: Guy Harris <guy@alum.mit.edu>
That matches what we do with the other two pairs of dump opening
routines.
Change-Id: I0e6e475573c3a8d4ab6cf991d0aadc14150af233
Reviewed-on: https://code.wireshark.org/review/11744
Reviewed-by: Guy Harris <guy@alum.mit.edu>
We just export some UI helpers and the Big Merge Engine.
Change-Id: I60bc8ab167e7100189a9ce60d84c0e4db27b6bda
Reviewed-on: https://code.wireshark.org/review/11689
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Add a dissector for reading Sysdig event blocks. It only handles plain
events but it's usable for reading trace files on hand here.
Use a script to generate various parts of the dissector. As an experiment,
update parts in-place instead of using a template.
Ultimately there should probably be a top-level "Syscall" or "Event"
dissector alongside the "Frame" dissector, which could then call this.
You could then directly compare an executable's system calls alongside
its network traffic.
For now leverage the pcapng_block dissector and keep everything under
"Frame".
Next steps:
- Items listed at the top of packet-sysdig-event.c.
Change-Id: I17077e8d7f40d10a946d61189ebc077d81c4da37
Reviewed-on: https://code.wireshark.org/review/11103
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Gerald Combs <gerald@wireshark.org>
The callers of wtap_dump_init_dumper() always call
wtap_dump_open_check() first, with the same arguments in all cases; pull
the latter call into wtap_dump_init_dumper() itself.
Change-Id: I2b44dc3a018745e175b5c74ff1a346749fec2b71
Reviewed-on: https://code.wireshark.org/review/11681
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Have a "this is stdout" flag for a wtap_dumper, and have "open the
standard output for dumping" routines that set that flag. When closing
a wtap_dumper, do most of the work regardless of whether we're writing
to the standard output or not (so that everything gets written out) and
only skip the closing of the underlying file descriptor.
Change-Id: I9f7e4d142b3bd598055d806b7ded1cb4c378de8e
Reviewed-on: https://code.wireshark.org/review/11673
Reviewed-by: Guy Harris <guy@alum.mit.edu>
That's a UI convention, and the GUI shouldn't honor that convention - a
user might get confused if they try to save to "-" and end up with
nothing (and with a ton of crap in a log file if programs launched from
the GUI end up with their standard output and error logged).
While we're at it, make randcap report write and close errors.
Change-Id: I9c450f0ca0320ce4c36d13d209b56d72edb43012
Reviewed-on: https://code.wireshark.org/review/11666
Reviewed-by: Guy Harris <guy@alum.mit.edu>
It doesn't actually *close* any handle, so it's best called a "finish"
routine rather than a "close" routine.
In libwiretap modules, don't bother setting the finish routine pointer
to null - it's already initialized to null (it's probably best not to
require modules to set it).
Change-Id: I19554f3fb826db495f17b36600ae36222cbc21b0
Reviewed-on: https://code.wireshark.org/review/11659
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Be more consistent about using the ws_ routines, as we suggest in
README.developer.
In C++ on UN*X, define ws_close as ::close rather than close, so that it
works even in classes with methods or members named "close".
Change-Id: Ide2652229e6b6b4624cbddae0e909a4ea1efa591
Reviewed-on: https://code.wireshark.org/review/11637
Reviewed-by: Guy Harris <guy@alum.mit.edu>
libwiretap no longer uses standard I/O routines to read files; those
includes are left over from when it did.
Change-Id: Ia46c5e24ed25c6bd254cd271746ace539a37e590
Reviewed-on: https://code.wireshark.org/review/11634
Reviewed-by: Guy Harris <guy@alum.mit.edu>
(And with #defines of read as _read and write as _write on Windows,
which might make structure members have surprising names if you try to
look at them in a debugger.)
Change-Id: Iaab5622cbde216d5fedd4bc014c83e4eef95f8a0
Reviewed-on: https://code.wireshark.org/review/11631
Reviewed-by: Guy Harris <guy@alum.mit.edu>
While we're at it, rename a variable to avoid colliding with the read()
routine.
Change-Id: I6629ec761f48751f34a2e7d04180d7583ad85710
Reviewed-on: https://code.wireshark.org/review/11626
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Have wsutil/file_util.h include them on UN*X, just as it includes io.h
on Windows, so we can have a rule of "if you do file operations, include
<wsutil/file_util.h> and use the routines in it".
Remove includes of unistd.h, fcntl.h, and sys/stat.h that aren't
necessary (whether because of the addition of them to wsutil/file_util.h
or because they weren't needed in the first place).
Change-Id: Ie241dd74deff284e39a5f690a297dbb6e1dc485f
Reviewed-on: https://code.wireshark.org/review/11619
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
We don't have any Flex scanners that support an interactive command-line
interface, so none of our scanners are, or need to be, interactive.
Mark text2pcap's scanner as not interactive.
That means none of our scanners should call isatty(), so they don't have
any need to include <io.h> on Windows; remove that include from the
Lucent/Ascent text capture scanner.
Update a comment to reflect that what matters isn't whether we can read
from a terminal or whether we actually do so, what matters is whether
they read *interactively* from a terminal (if you want to run text2pcap
reading from the standard input and type at it, be my guest).
Change-Id: I59979d1fdb37e1913125a400963ff7a3fa6b9bbd
Reviewed-on: https://code.wireshark.org/review/11587
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
Move the definitions of hashipv4_t and hashipv6_t to wiretap/wtap.h, as
that's the main place they're used. Change them a bit not to depend on
other stuff from libwireshark, and change the code as required by those
changes.
This should fix the Solaris build; apparently, the Sun^WOracle compiler
is generating code for static inline functions even if they're never
called, so that libwiretap ends up including code that calls tvbuff and
wmem functions.
There's probably further cleanup that could be done here, but this
should at least fix the build, as well as getting rid of a dependency
between two libraries that are at least somewhat independent (libwiretap
should *not* depend on libwireshark, as some programs use libwiretap but
not libwireshark, and, ultimately, we probably want it to be possible to
use libwireshark without libwiretap but that'd be more work).
Change-Id: I91c745282f17d7c8bff7809aa277eab2b3cf47c1
Reviewed-on: https://code.wireshark.org/review/11537
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
