Tshark custom columns: Why don’t I get an error message?

Question

Correct syntax: $ tshark -r test.pcap -R "frame.number<6" -o column.format:""No.","%m", "tcp.port", "%Cus:tcp.port", "udp.port", "%Cus:udp.port"" 1 55556,53 2 53,55556 3 1685,80 4 80,1685 5 1685,80 I get an error message, when I make a typo: %Cu:udp.port (instead of %Cus:udp.port) $ tshark -r test.pcap -R "frame.number<6" -o column.format:""No.","%m", "tcp.port", "%Cus:tcp.port", "udp.port", "%Cu:udp.port"" tshark: Invalid -o flag "column.format:No.,%m, tcp.port, %Cus:tcp.port, udp.port, %Cu:udp.port" Why don't I get messages for the following typo's? $ tshark -r test.pcap -R "frame.number<6" -o column.format:""No.","%m", "tcp.port", "%Cus:tcp.port", "udp.port", "%Cust:udp.port"" 1 2 3 1685,80 4 80,1685 5 1685,80

$ tshark -r test.pcap -R "frame.number<6" -o column.format:""No.","%m", "tcp.port", "%Cus:tcp.port", "udp.port", "%Custttttttttttttt:udp.port"" 1 2 3 1685,80 4 80,1685 5 1685,80

Accepted Answer

The bug is that prefs.c:2044 and prefs.c:2069 compare only the first few characters of "%Custttttttttttttt", which match the expected string (%Cus):

const gchar *cust_format = col_format_to_string(COL_CUSTOM);
size_t cust_format_len = strlen(cust_format);
//...
if (strncmp(col_l_elt->data, cust_format, cust_format_len) == 0) {
        cfmt->fmt      = g_strdup(cust_format);
        prefs_fmt      = g_strdup(col_l_elt->data);
        cust_format_info = g_strsplit(&prefs_fmt[cust_format_len+1],":",3); /* add 1 for ':' */
        cfmt->custom_field = g_strdup(cust_format_info[0]);
//....

If we add 1 to cust_format_len, the string comparison would include the null terminator in cust_format, which would cause the desired syntax error:

if (strncmp(col_l_elt->data, cust_format, cust_format_len+1) == 0) {
//...