This is our old Q&A Site. Please post any new questions and answers at


I've been trying to use the following function to add some decoded text to a colum with the col_add_fstr() function.

WS_DLL_PUBLIC proto_item * proto_tree_add_item_ret_string(proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, wmem_allocator_t *scope, const guint8 **retval);

I've read README.wmem, but still, I don't understand how to simply return the decoded string.

asked 22 Feb '16, 02:14

_michel's gravatar image

accept rate: 0%

The rdp dissector uses the function, around line 2161 if that helps.

You haven't really described your issue, please amend your question to show how you're attempting to call the function from your code.

permanent link

answered 22 Feb '16, 02:25

grahamb's gravatar image

grahamb ♦
accept rate: 22%

edited 09 Feb '17, 06:49

Thank you, it works. In case someone is interested, I paste here the relevant lines :

static int
dissect_rdp_cr(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void* data _U_)
    const guint8 *stringval;
    proto_tree_add_item_ret_string(tree, hf_rdp_rt_cookie, tvb, offset,
                                   linelen, ENC_ASCII|ENC_NA,
                                   wmem_packet_scope(), &stringval);

with the following declaraction in wmem_scopes.h

wmem_allocator_t *
(22 Feb '16, 07:41) _michel

I don't understand how to simply return the decoded string.

How long do you need the string to last? That determines the scope to pass to proto_tree_add_item_ret_string(). If you only need it to use within the dissector call, wmem_packet_scope() is, in fact, the right answer. If its value needs to persist past the end of dissection, you'd need a different scope.

permanent link

answered 22 Feb '16, 16:59

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

edited 22 Feb '16, 17:00

I don't know exactly, I just need it to be displayed in the column info. Since I don't know what and when is being freed by Wireshark, I can't tell the scope I need.

I've looked in README.wmem but I don't have the necessary experience to choose between packet, file or epan pool. Off the top of my head, I'd say that packet pool, hence wmempacketscope(), is ok. I'd need a clear example to understand the limitations of each pool.

(22 Feb '16, 23:55) _michel

I just need it to be displayed in the column info.

Then you'll probably be doing col_add_str() or col_add_fstr(); neither of those routines keep copies of the string pointers passed to them, so they could be freed at any point, and wmem_packet_scope() would suffice.

(23 Feb '16, 15:12) Guy Harris ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 22 Feb '16, 02:14

question was seen: 1,647 times

last updated: 09 Feb '17, 23:03

p​o​w​e​r​e​d by O​S​Q​A