Question

我有一个简单的Wireshark解剖器，当它针对捕获运行时抛出以下错误警告：

13:04:12          Warn Dissector bug, protocol usbserial, in packet 353: /wireshark/epan/proto.c:5504: 
failed assertion "idx >= 0 && idx < num_tree_types"

协议注册功能如下所示：

static gint ett_myproto = -1;

void 
proto_register_myproto(void)
{
    /* Set up field array */
    static hf_register_info hf[] = {
        { &hf_myproto_payload,
            {"Payload", "myproto.payload", FT_BYTES, BASE_NONE, NULL,
                0x0, NULL, HFILL }},
    };

    /* Register protocol */
    proto_myproto = proto_register_protocol("My Protocol", "myproto", "myproto");
    /* Register protocol fields */
    proto_register_field_array(proto_myproto, hf, array_length(hf));

    /* Register the dissector */
    register_dissector("myproto", dissect_myproto, proto_myproto);
}

解剖器会对数据进行一些常规处理，但问题区域的核心似乎是：

static int
dissect_myproto(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
        void *data _U_)
{
    proto_item *ti;
    proto_tree *myproto_tree;

    /* Create top tree and add to the item */
    ti = proto_tree_add_protocol_format(tree, proto_myproto, tvb, 0, -1,
            "My Protocol");
    myproto_tree = proto_item_add_subtree(ti, ett_myproto);

    proto_tree_add_bytes_format(myproto_tree, hf_myproto_payload,
            tvb, 0, payload_len,
            NULL, "Payload");
}

要使协议正确填充子树，我需要做什么？

Answer 1

这里的问题是未能将子树注册为子树数组的一部分（来自here的提示）。

这是在协议注册功能中完成的，需要＆＃34;打包＆＃34;将子树变量（其中只有一个：ett_myproto）放入一个数组中，然后使用proto_register_subtree_array注册该数组：

static gint ett_myproto = -1;

void 
proto_register_myproto(void)
{
    /* Set up field array */
    static hf_register_info hf[] = {
        ....
    };

    /* Register protocol */
    proto_myproto = proto_register_protocol("My Protocol", "myproto", "myproto");
    /* Register protocol fields */
    proto_register_field_array(proto_myproto, hf, array_length(hf));

    /* Setup and register all protocol subtrees */
    static gint *ett[] = {
        &ett_myproto,
    };

    proto_register_subtree_array(ett, array_length(ett));

    /* Register the dissector */
    register_dissector("myproto", dissect_myproto, proto_myproto);
}

ett变量是用于引用有关子树状态的GUI信息的索引（例如，是否已扩展）。

填充子树时Wireshark C解剖器错误

1 个答案: