Re: [Ethereal-dev] [PATCH] packet-dcerpc.c: clamp to tvb length and display multiple lines

[Guy Harris <gharris@xxxxxxxxx>]

Charles Levert wrote:

> Ok.  I have removed the extra length check from my patch.  I have
> added a dissection line to account for padding octets, if any (they
> were just skipped without explanation, previously).

There are other places in the DCE RPC dissector - and other dissectors - 
where padding isn't put into the protocol tree.  Should it always be put 
into the protocol tree?

> The main change
> of the patch remains breaking the message down into separate lines for
> improved readability.

Should that be done for *all* strings, or just for *some* strings?  And 
should it be done only if the string contains at least one newline?

And should this be done in lower-level code, i.e. in the code that puts 
a string value into the protocol tree, so that it's done for all 
dissectors that put FT_STRING, FT_STRINGZ, or FT_UINT_STRING fields into 
the protocol tree, or for selected strings of that type, regardless of 
whether it's in DCE RPC or not?