https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16778
--- Comment #3 from allenmeno...@outlook.com ---
(In reply to Guy Harris from comment #2)
> (In reply to allenmenor16 from comment #0)
> > Steps to Reproduce:
> > 1. In Analyze > Display Filter Macros, create a complex macro with macros
> > separated by '&&' or '||'
> >
> > For example, complex macro 'R4' has the following text ${R:$1} && ${4RS}0
>
> Presumably you've already defined the macros "R" and "4RS"; how are they
> defined?
>
> > 2. Apply the macro in 'Apply a display filter' bar typing in the complex
> > macro
> > 'R4'
>
> That's not how you apply a macro. "R4", as a packet-matching expression,
> means "does the packet have a field named 'R4' in it?" To apply the macro,
> you'd type in something such as "${R4:fff}", where "fff" is what should get
> passed to the macro "R".
Yes, the macros I have been using did not crash, and worked, with packets being
filtered correctly in Wireshark versions up to 3.2.3, and crash in Wireshark
3.2.4 and later versions.
In regards to defining macros, I provided the example of "R" and "4RS" due to
macros being confidential information. For the case of this bug report, I have
defined a few macros below:
W - wlan.sa contains 0912.F4$1 ($1 being the remainder of the IP)
2DS - (wlan.fc.ds == 0x01)
WB - (${W:$1} && ${2DS})
nRt - wlan.fc.retry == 0
WBR2 (${WB:$1} && ${nRt}.
Typing the macro "${WBR2$1} into the display filter bar crashes Wireshark.
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
