11644473600ULL
Don't assume that you can scan through a va_list initialized by va_start
-more than once without closing it with va_end and re-initalizing it with
+more than once without closing it with va_end and re-initializing it with
va_start. This applies even if you're not scanning through it yourself,
but are calling a routine that scans through it, such as vfprintf() or
one of the routines in Wireshark that takes a format and a va_list as an
unaligned access for you, and will, on at least some platforms, cause
the program to be terminated.
-Wireshark supports platforms with GLib 2.4[.x]/GTK+ 2.4[.x] or newer.
-If a Glib/GTK+ mechanism is available only in Glib/GTK+ versions
-newer than 2.4/2.4 then use "#if GTK_CHECK_VERSION(...)" to conditionally
-compile code using that mechanism.
+Wireshark supports platforms with GLib 2.14[.x]/GTK+ 2.12[.x] or newer.
+If a Glib/GTK+ mechanism is available only in Glib/GTK+ versions newer
+than 2.14/2.12 then use "#if GLIB_CHECK_VERSION(...)" or "#if
+GTK_CHECK_VERSION(...)" to conditionally compile code using that
+mechanism.
When different code must be used on UN*X and Win32, use a #if or #ifdef
that tests _WIN32, not WIN32. Try to write code portably whenever
you're using non-mod-8 tabs. The tabs-vs-spaces document above provides
examples of Emacs and vi modelines for this purpose.
+Please do not leave trailing whitespace (spaces/tabs) on lines.
+
When editing an existing file, try following the existing indentation
logic and even if it very tempting, never ever use a restyler/reindenter
utility on an existing file. If you run across wildly varying
should be changed to include that file.
You may not need to include all the headers listed in the skeleton
-below, and you may need to include additional headers. For example, the
-code inside
-
- #ifdef HAVE_LIBPCRE
-
- ...
-
- #endif
-
-is needed only if you are using a function from libpcre, e.g. the
-"pcre_compile()" function.
+below, and you may need to include additional headers.
The stdio.h, stdlib.h and string.h header files should be included only as needed.
Use this function instead of prefs_register_protocol if you want to group
preferences of several protocols under one preferences subtree.
Argument subtree identifies grouping tree node name, several subnodes can be
- specified usign slash '/' (e.g. "OSI/X.500" - protocol preferences will be
+ specified using slash '/' (e.g. "OSI/X.500" - protocol preferences will be
accessible under Protocols->OSI->X.500-><PROTOSHORTNAME> preferences node.
*/
PROTOABBREV_module = prefs_register_protocol_subtree(const char *subtree,
#endif
+/*
+ * Editor modelines - http://www.wireshark.org/tools/modelines.html
+ *
+ * Local variables:
+ * c-basic-offset: 4
+ * tab-width: 8
+ * indent-tabs-mode: nil
+ * End:
+ *
+ * vi: set shiftwidth=4 tabstop=8 expandtab:
+ * :indentSize=4:tabSize=8:noTabs=true:
+ */
+
+
------------------------------------Cut here------------------------------------
1.3 Explanation of needed substitutions in code skeleton.
FIELDTYPE FT_NONE, FT_BOOLEAN, FT_UINT8, FT_UINT16, FT_UINT24,
FT_UINT32, FT_UINT64, FT_INT8, FT_INT16, FT_INT24, FT_INT32,
FT_INT64, FT_FLOAT, FT_DOUBLE, FT_ABSOLUTE_TIME,
- FT_RELATIVE_TIME, FT_STRING, FT_STRINGZ, FT_EBCDIC,
+ FT_RELATIVE_TIME, FT_STRING, FT_STRINGZ, FT_EUI64,
FT_UINT_STRING, FT_ETHER, FT_BYTES, FT_UINT_BYTES, FT_IPv4,
FT_IPv6, FT_IPXNET, FT_FRAMENUM, FT_PROTOCOL, FT_GUID, FT_OID
FIELDDISPLAY For FT_UINT{8,16,24,32,64} and FT_INT{8,16,24,32,64):
guint8 tvb_get_guint8(tvbuff_t*, gint offset);
Network-to-host-order accessors for 16-bit integers (guint16), 24-bit
-integers, 32-bit integers (guint32), and 64-bit integers (guint64):
+integers, 32-bit integers (guint32), 40-bit integers, 48-bit integers,
+56-bit integers and 64-bit integers (guint64):
guint16 tvb_get_ntohs(tvbuff_t*, gint offset);
guint32 tvb_get_ntoh24(tvbuff_t*, gint offset);
guint32 tvb_get_ntohl(tvbuff_t*, gint offset);
+guint64 tvb_get_ntoh40(tvbuff_t*, gint offset);
+guint64 tvb_get_ntoh48(tvbuff_t*, gint offset);
+guint64 tvb_get_ntoh56(tvbuff_t*, gint offset);
guint64 tvb_get_ntoh64(tvbuff_t*, gint offset);
Network-to-host-order accessors for single-precision and
gdouble tvb_get_ntohieee_double(tvbuff_t*, gint offset);
Little-Endian-to-host-order accessors for 16-bit integers (guint16),
-24-bit integers, 32-bit integers (guint32), and 64-bit integers
-(guint64):
+24-bit integers, 32-bit integers (guint32), 40-bit integers, 48-bit
+integers, 56-bit integers, and 64-bit integers (guint64):
guint16 tvb_get_letohs(tvbuff_t*, gint offset);
guint32 tvb_get_letoh24(tvbuff_t*, gint offset);
guint32 tvb_get_letohl(tvbuff_t*, gint offset);
+guint64 tvb_get_letoh40(tvbuff_t*, gint offset);
+guint64 tvb_get_letoh48(tvbuff_t*, gint offset);
+guint64 tvb_get_letoh56(tvbuff_t*, gint offset);
guint64 tvb_get_letoh64(tvbuff_t*, gint offset);
Little-Endian-to-host-order accessors for single-precision and
String accessors:
guint8 *tvb_get_string(tvbuff_t*, gint offset, gint length);
+gchar *tvb_get_unicode_string(tvbuff_t *tvb, const gint offset, gint length, const guint encoding);
guint8 *tvb_get_ephemeral_string(tvbuff_t*, gint offset, gint length);
+gchar *tvb_get_ephemeral_unicode_string(tvbuff_t *tvb, const gint offset, gint length, const guint encoding);
guint8 *tvb_get_seasonal_string(tvbuff_t*, gint offset, gint length);
Returns a null-terminated buffer containing data from the specified
g_free() it when you are finished with the string. Failure to g_free() this
buffer will lead to memory leaks.
+tvb_get_unicode_string() is a unicode (UTF-16) version of above. This
+is intended for reading UTF-16 unicode strings out of a tvbuff and
+returning them as a UTF-8 string for use in Wireshark. The offset and
+returned length pointer are in bytes, not UTF-16 characters.
+
tvb_get_ephemeral_string() returns a buffer allocated from a special heap
with a lifetime until the next packet is dissected. You do not need to
free() this buffer, it will happen automatically once the next packet is
dissected.
+tvb_get_ephemeral_unicode_string() is a unicode (UTF-16) version of above.
+This is intended for reading UTF-16 unicode strings out of a tvbuff and
+returning them as a UTF-8 string for use in Wireshark. The offset and
+returned length pointer are in bytes, not UTF-16 characters.
+
tvb_get_seasonal_string() returns a buffer allocated from a special heap
with a lifetime of the current capture session. You do not need to
free() this buffer, it will happen automatically once the a new capture or
file is opened.
guint8 *tvb_get_stringz(tvbuff_t *tvb, gint offset, gint *lengthp);
+const guint8 *tvb_get_const stringz(tvbuff_t *tvb, gint offset, gint *lengthp);
guint8 *tvb_get_ephemeral_stringz(tvbuff_t *tvb, gint offset, gint *lengthp);
+gchar *tvb_get_ephemeral_unicode_stringz(tvbuff_t *tvb, const gint offset, gint *lengthp, const guint encoding);
guint8 *tvb_get_seasonal_stringz(tvbuff_t *tvb, gint offset, gint *lengthp);
-Returns a null-terminated buffer, allocated with "g_malloc()",
-containing data from the specified tvbuff, starting at the
-specified offset, and containing all characters from the tvbuff up to
-and including a terminating null character in the tvbuff. "*lengthp"
-will be set to the length of the string, including the terminating null.
+Returns a null-terminated buffer containing data from the specified tvbuff,
+starting at the specified offset, and containing all characters from the
+tvbuff up to and including a terminating null character in the tvbuff.
+"*lengthp" will be set to the length of the string, including the terminating
+null.
tvb_get_stringz() returns a buffer allocated by g_malloc() so you must
g_free() it when you are finished with the string. Failure to g_free() this
buffer will lead to memory leaks.
+
+tvb_get_const_stringz() returns a pointer to the (const) string in the tvbuff.
+You do not need to free() this buffer, it will happen automatically once the
+next packet is dissected. This function is slightly more efficient than the
+others because it does not allocate memory and copy the string.
+
tvb_get_ephemeral_stringz() returns a buffer allocated from a special heap
with a lifetime until the next packet is dissected. You do not need to
free() this buffer, it will happen automatically once the next packet is
dissected.
+tvb_get_ephemeral_unicode_stringz() is a unicode (UTF-16) version of
+above. This is intended for reading UTF-16 unicode strings out of a tvbuff
+and returning them as a UTF-8 string for use in Wireshark. The offset and
+returned length pointer are in bytes, not UTF-16 characters.
+
tvb_get_seasonal_stringz() returns a buffer allocated from a special heap
with a lifetime of the current capture session. You do not need to
free() this buffer, it will happen automatically once the a new capture or
file is opened.
-guint8 *tvb_fake_unicode(tvbuff_t*, gint offset, gint length, gboolean little_endian);
-guint8 *tvb_get_ephemeral_faked_unicode(tvbuff_t*, gint offset, gint length, gboolean little_endian);
+tvb_fake_unicode() has been superseded by tvb_get_unicode_string(), which
+properly handles Unicode (UTF-16) strings by converting them to UTF-8.
-Converts a 2-byte unicode string to an ASCII string.
-Returns a null-terminated buffer containing data from the specified
-tvbuff, starting at the specified offset, and containing the specified
-length worth of characters (the length of the buffer will be length+1,
-as it includes a null character to terminate the string).
-
-tvb_fake_unicode() returns a buffer allocated by g_malloc() so you must
-g_free() it when you are finished with the string. Failure to g_free() this
-buffer will lead to memory leaks.
-tvb_get_ephemeral_faked_unicode() returns a buffer allocated from a special
-heap with a lifetime until the next packet is dissected. You do not need to
-free() this buffer, it will happen automatically once the next packet is
-dissected.
+tvb_get_ephemeral_faked_unicode() has been superseded by
+tvb_get_ephemeral_string(), which properly handles Unicode (UTF-16) strings by
+converting them to UTF-8.
Byte Array Accessors:
This function is similar to tvb_bytes_to_str(...) except that 'punct' is inserted
between the hex representation of each byte.
+gchar *tvb_bcd_dig_to_ep_str(tvbuff_t *tvb, const gint offset, const gint len, dgt_set_t *dgt, gboolean skip_first);
+
+Given a tvbuff, an offset into the tvbuff, and a length that starts
+at that offset (which may be -1 for "all the way to the end of the
+tvbuff"), fetch BCD encoded digits from a tvbuff starting from either
+the low or high half byte, formatting the digits according to an input digit set,
+if NUll a default digit set of 0-9 returning "?" for overdecadic digits will be used.
+A pointer to the EP allocated string will be returned.
+Note: a tvbuff content of 0xf is considered a 'filler' and will end the conversion.
Copying memory:
guint8* tvb_memcpy(tvbuff_t*, guint8* target, gint offset, gint length);
FT_INT64 A 64-bit signed integer.
FT_FLOAT A single-precision floating point number.
FT_DOUBLE A double-precision floating point number.
- FT_ABSOLUTE_TIME Seconds (4 bytes) and nanoseconds (4 bytes)
- of time since January 1, 1970, midnight
- UTC, displayed as the date, followed by
- the time, as hours, minutes, and seconds
- with 9 digits after the decimal point.
+ FT_ABSOLUTE_TIME An absolute time from some fixed point in time,
+ displayed as the date, followed by the time, as
+ hours, minutes, and seconds with 9 digits after
+ the decimal point.
FT_RELATIVE_TIME Seconds (4 bytes) and nanoseconds (4 bytes)
of time relative to an arbitrary time.
displayed as seconds and 9 digits
after the decimal point.
FT_STRING A string of characters, not necessarily
- NUL-terminated, but possibly NUL-padded.
+ NULL-terminated, but possibly NULL-padded.
This, and the other string-of-characters
types, are to be used for text strings,
not raw binary data.
- FT_STRINGZ A NUL-terminated string of characters.
- FT_EBCDIC A string of characters, not necessarily
- NUL-terminated, but possibly NUL-padded.
- The data from the packet is converted from
- EBCDIC to ASCII before displaying to the user.
+ FT_STRINGZ A NULL-terminated string of characters.
+ The string length is normally the length
+ given in the proto_tree_add_item() call.
+ However if the length given in the call
+ is -1, then the length used is that
+ returned by calling tvb_strsize().
FT_UINT_STRING A counted string of characters, consisting
of a count (represented as an integral value,
of width given in the proto_tree_add_item()
address.
FT_GUID A Globally Unique Identifier
FT_OID An ASN.1 Object Identifier
+ FT_EUI64 A EUI-64 Address
Some of these field types are still not handled in the display filter
routines, but the most common ones are. The FT_UINT* variables all
If all of a contiguous range of values from min to max are present in the array
the value will be used as as a direct index into a value_string array.
-If the values in the array are not contiguous (ie: there are "gaps"), but are in assending order
-a binary search will be used.
+If the values in the array are not contiguous (ie: there are "gaps"), but are
+in ascending order a binary search will be used.
-Note: "gaps" in a value_string array can be filled with "empty" entries eg: {value, "Unknown"} so that
-direct access to the array is is possible.
+Note: "gaps" in a value_string array can be filled with "empty" entries eg:
+{value, "Unknown"} so that direct access to the array is is possible.
-The init macro (see below) will perform a check on the value string
-the first time it is used to determine which search algorithm fits and fall back to a linear search
-if the value_string does not meet the criteria above.
+The init macro (see below) will perform a check on the value string the first
+time it is used to determine which search algorithm fits and fall back to a
+linear search if the value_string does not meet the criteria above.
-Use this macro to initialise the extended value_string at comile time:
+Use this macro to initialize the extended value_string at compile time:
static value_string_ext valstringname_ext = VALUE_STRING_EXT_INIT(valstringname);
-Extended value strings can be created at runtime by calling
+Extended value strings can be created at run time by calling
value_string_ext_new(<ptr to value_string array>,
<total number of entries in the value_string_array>, /* include {0, NULL} entry */
<value_string_name>);
-For hf[] array FT_(U)INT* fields that need a 'valstringname_ext' struct, the 'strings' field
-would be set to '&valstringname_ext)'. Furthermore, 'display' field must be
-ORed with 'BASE_EXT_STRING' (e.g. BASE_DEC|BASE_EXT_STRING).
+For hf[] array FT_(U)INT* fields that need a 'valstringname_ext' struct, the
+'strings' field would be set to '&valstringname_ext)'. Furthermore, 'display'
+field must be ORed with 'BASE_EXT_STRING' (e.g. BASE_DEC|BASE_EXT_STRING).
-- Ranges
in your "register" routine, just as you register the protocol and the
fields for that protocol.
+The ett_ variables identify particular type of subtree so that if you expand
+one of them, Wireshark keeps track of that and, when you click on
+another packet, it automatically opens all subtrees of that type.
+If you close one of them, all subtrees of that type will be closed when
+you move to another packet.
+
There are several functions that the programmer can use to add either
protocol or field labels to the proto_tree:
proto_tree_add_oid_format(tree, id, tvb, start, length, value_ptr,
format, ...);
+ proto_item *
+ proto_tree_add_eui64(tree, id, tvb, start, length, value);
+
+ proto_item *
+ proto_tree_add_eui64_format(tree, id, tvb, start, length, value,
+ format, ...);
+
+ proto_item *
+ proto_tree_add_eui64_format_value(tree, id, tvb, start, length,
+ value, format, ...);
+
proto_item *
proto_tree_add_oid_format_value(tree, id, tvb, start, length,
value_ptr, format, ...);
The item added to the GUI tree will contain the name (as passed in the
proto_register_*() function) and a value. The value will be fetched
from the tvbuff by proto_tree_add_item(), based on the type of the field
-and, for integral and Boolean fields, the byte order of the value; the
-byte order, for items for which that's relevant, is specified by the
-'encoding' argument, which is ENC_LITTLE_ENDIAN if the value is
-little-endian and ENC_BIG_ENDIAN if it is big-endian. If the byte order
-is not relevant, use ENC_NA (Not Applicable). In the future, other
-elements of the encoding, such as the character encoding for
-character strings, might be supported.
+and the encoding of the value as specified by the "encoding" argument.
+
+For FT_NONE, FT_BYTES, FT_ETHER, FT_IPv6, FT_IPXNET, FT_OID fields,
+and 'protocol' fields the encoding is not relevant; the 'encoding'
+argument should be ENC_NA (Not Applicable).
+
+For integral, floating-point, Boolean, FT_GUID, and FT_EUI64 fields,
+the encoding specifies the byte order of the value; the 'encoding'
+argument should be is ENC_LITTLE_ENDIAN if the value is little-endian
+and ENC_BIG_ENDIAN if it is big-endian.
+
+For FT_IPv4 fields, the encoding also specifies the byte order of the
+value. In almost all cases, the encoding is in network byte order,
+hence big-endian, but in at least one protocol dissected by Wireshark,
+at least one IPv4 address is byte-swapped, so it's in little-endian
+order.
+
+For string fields, the encoding specifies the character set used for the
+string and the way individual code points in that character set are
+encoded. For FT_UINT_STRING fields, the byte order of the count must be
+specified; when support for UTF-16 encoding is added, the byte order of
+the encoding will also have to be specified. In other cases, ENC_NA
+should be used. The character encodings that are currently
+supported are:
+
+ ENC_UTF_8 - UTF-8
+ ENC_ASCII - ASCII (currently treated as UTF-8; in the future,
+ all bytes with the 8th bit set will be treated as
+ errors)
+ ENC_EBCDIC - EBCDIC
+
+Other encodings will be added in the future.
+
+For FT_ABSOLUTE_TIME fields, the encoding specifies the form in which
+the time stamp is specified, as well as its byte order. The time stamp
+encodings that are currently supported are:
+
+ ENC_TIME_TIMESPEC - seconds (4 bytes) and nanoseconds (4 bytes)
+ of time since January 1, 1970, midnight UTC.
+
+ ENC_TIME_NTP - an NTP timestamp, represented as a 64-bit
+ unsigned fixed-point number, in seconds relative to 0h
+ on 1 January 1900. The integer part is in the first 32
+ bits and the fraction part in the last 32 bits.
+
+For other types, there is no support for proto_tree_add_item().
Now that definitions of fields have detailed information about bitfield
fields, you can use proto_tree_add_item() with no extra processing to
proto_tree_add_int64()
proto_tree_add_guid()
proto_tree_add_oid()
+proto_tree_add_eui64()
------------------------
These routines are used to add items to the protocol tree if either:
For proto_tree_add_bytes(), the 'value_ptr' argument is a pointer to a
sequence of bytes.
+For proto_tree_add_bytes_format() and proto_tree_add_bytes_format_value(), the
+'value_ptr' argument is a pointer to a sequence of bytes or NULL if the bytes
+should be taken from the given TVB using the given offset and length.
+
For proto_tree_add_time(), the 'value_ptr' argument is a pointer to an
"nstime_t", which is a structure containing the time to be added; it has
'secs' and 'nsecs' members, giving the integral part and the fractional
For proto_tree_add_oid(), the 'value_ptr' argument is a pointer to an
ASN.1 Object Identifier.
+For proto_tree_add_eui64(), the 'value' argument is a 64-bit integer
+value
+
proto_tree_add_bytes_format()
proto_tree_add_time_format()
proto_tree_add_ipxnet_format()
proto_tree_add_int64_format()
proto_tree_add_guid_format()
proto_tree_add_oid_format()
+proto_tree_add_eui64_format()
----------------------------
These routines are used to add items to the protocol tree when the
dissector routine wants complete control over how the field and value
proto_tree_add_int64_format_value()
proto_tree_add_guid_format_value()
proto_tree_add_oid_format_value()
+proto_tree_add_eui64_format_value()
------------------------------------
These routines are used to add items to the protocol tree when the
...
static gint ett_scsi_inq_peripheral = -1;
...
- static const int *peripheal_fields[] = {
+ static const int *peripheral_fields[] = {
&hf_scsi_inq_qualifier,
&hf_scsi_inq_devtype,
NULL
...
/* Qualifier and DeviceType */
proto_tree_add_bitmask(tree, tvb, offset, hf_scsi_inq_peripheral,
- ett_scsi_inq_peripheral, peripheal_fields, FALSE);
+ ett_scsi_inq_peripheral, peripheral_fields, FALSE);
offset+=1;
...
{ &hf_scsi_inq_peripheral,
See <http://www.wireshark.org/develop.html>
+
+1.10a Using git with the SVN source code tree.
+
+ Install git and the git-svn package.
+ Run "mkdir git; cd git; git svn clone <svn-url>", e.g. if you are using
+ the anonymous svn tree, run
+ "git svn clone http://anonsvn.wireshark.org/wireshark/trunk/"
+
+ After that, a typical workflow may look like this (from "man git-svn"):
+
+ # Clone a repo (like git clone):
+ git svn clone http://svn.example.com/project/trunk
+ # Enter the newly cloned directory:
+ cd trunk
+ # You should be on master branch, double-check with ´git branch´
+ git branch
+ # Do some work and commit locally to git:
+ git commit ...
+ # Something is committed to SVN, rebase your local changes against the
+ # latest changes in SVN:
+ git svn rebase
+ # Now commit your changes (that were committed previously using git) to SVN
+ # as well as automatically updating your working HEAD:
+ git svn dcommit
+ # Append svn:ignore settings to the default git exclude file:
+ git svn show-ignore >> .git/info/exclude
+
+
1.11 Submitting code for your new dissector.
- VERIFY that your dissector code does not use prohibited or deprecated APIs
uses conversation timestamps that makes it possible to enable and
disable the calculation of conversation timestamps. The main argument
for this is that a higher level conversation is able to overwrite
-the values of lowel level conversations in these two columns. Being
+the values of lower level conversations in these two columns. Being
able to actively select which protocols may overwrite the conversation
timestamp columns gives the user the power to control these columns.
(A second reason is that conversation timestamps use the per-packet
"." between them, to construct a name that identifies
the field in the preference file; the name itself
should not include the protocol name, as the name in
- the preference file will already have it
+ the preference file will already have it. Make sure that
+ only lower-case ASCII letters, numbers, underscores and
+ dots appear in the preference name.
title - Field title in the preferences dialog
description - Comments added to the preference file above the
- preference value
+ preference value and shown as tooltip in the GUI, or NULL
var - pointer to the storage location that is updated when the
field is changed in the preference dialog box. Note that
with string preferences the given pointer is overwritten
};
/**
-* Dissect a buffer containing C strings.
+* Dissect a buffer containing ASCII C strings.
*
* @param tvb The buffer to dissect.
* @param pinfo Packet Info.
if (tree) {
proto_tree_add_item(tree, hf_cstring, tvb, offset, len,
- ENC_NA);
+ ENC_ASCII|ENC_NA);
}
offset += (guint)len;
}
ptvcursor API.
proto_item*
-ptvcursor_add(ptvcursor_t* ptvc, int hf, gint length, gboolean endianness)
+ptvcursor_add(ptvcursor_t* ptvc, int hf, gint length, const guint encoding)
This will extract 'length' bytes from the tvbuff and place it in
the proto_tree as field 'hf', which is a registered header_field. The
pointer to the proto_item that is created is passed back to you. Internally,
the ptvcursor advances its cursor so the next call to ptvcursor_add
-starts where this call finished. The 'endianness' parameter matters for
-FT_UINT* and FT_INT* fields.
+starts where this call finished. The 'encoding' parameter is relevant for
+certain type of fields (See above under proto_tree_add_item()).
proto_item*
-ptvcursor_add_no_advance(ptvcursor_t* ptvc, int hf, gint length, gboolean endianness)
+ptvcursor_add_no_advance(ptvcursor_t* ptvc, int hf, gint length, const guint encoding)
Like ptvcursor_add, but does not advance the internal cursor.
void
proto_tree*
ptvcursor_add_with_subtree(ptvcursor_t* ptvc, int hfindex, gint length,
- gboolean little_endian, gint ett_subtree);
+ const guint encoding, gint ett_subtree);
Adds an item to the tree and creates a subtree.
If the length is unknown, length may be defined as SUBTREE_UNDEFINED_LENGTH.
In this case, at the next pop, the item length will be equal to the advancement
git.samba.org / obnox / wireshark / wip.git / blobdiff