I have this lua dissector using:
s = buffer(1, len):raw()
But the result is that s contains all data in buffer, i.e. looks like to ignore the len parameter.
When I modify this to:
s = buffer(1, len):tvb():raw() it works.
Can this be explained or am I doing something wrong?
A quick look at epan/wslua/wslua_tvb.c seems to show that TvbRange_raw() works with the underlying TVB based on the parameters passed into this functions, not based on the boundaries set by the creation of the TvbRange.
When looking at TvbRange_tvb() a actual new TVB is created, based on the given boundaries set by the creation of the TvbRange. So taking raw() from that new Tvb does yield the desired result.
So yes, this can be explained, and no, you're not doing something wrong. You just happened to find the workaround.
Asked: 2020-11-20 10:45:41 +0000
Seen: 172 times
Last updated: Nov 20 '20
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
What is buffer, how is it created?
buffer is the first parameter for the dissector (company coding standard):
-- Create a function to dissect it function myprotocol.dissector(buffer, pinfo, tree )