https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14180

--- Comment #3 from Peter Wu <pe...@lekensteyn.nl> ---
To illustrate the compiled logic, this is what is currently being created for a
hypothethical "tcp.port in {1-4 6 8-9}" filter:

(tcp.port >= 1 and tcp.port <= 4) or
tcp.port == 6 or
(tcp.port >= 8 and tcp.port <= 9)

Constants:
00000 PUT_FVALUE        1 <FT_UINT16> -> reg#1
00001 PUT_FVALUE        4 <FT_UINT16> -> reg#2
00002 PUT_FVALUE        6 <FT_UINT16> -> reg#3
00003 PUT_FVALUE        8 <FT_UINT16> -> reg#4
00004 PUT_FVALUE        9 <FT_UINT16> -> reg#5

Instructions:
00000 READ_TREE         tcp.port -> reg#0
00001 IF-FALSE-GOTO     19
00002 ANY_GE            reg#0 == reg#1
00003 IF-FALSE-GOTO     8
00004 READ_TREE         tcp.port -> reg#0
00005 IF-FALSE-GOTO     19
00006 ANY_LE            reg#0 == reg#2
00007 IF-TRUE-GOTO      19
00008 READ_TREE         tcp.port -> reg#0
00009 IF-FALSE-GOTO     19
00010 ANY_EQ            reg#0 == reg#3
00011 IF-TRUE-GOTO      19
00012 READ_TREE         tcp.port -> reg#0
00013 IF-FALSE-GOTO     19
00014 ANY_GE            reg#0 == reg#4
00015 IF-FALSE-GOTO     19
00016 READ_TREE         tcp.port -> reg#0
00017 IF-FALSE-GOTO     19
00018 ANY_LE            reg#0 == reg#5
00019 RETURN

which is basically:

 x = read tcp.port
 if (x exists) {
   if (x >= 1 && x <= 4) return TRUE;
   if (x == 6) return TRUE;
   if (x >= 8 && y <= 9) return TRUE;
 }
 return FALSE;

-- 
You are receiving this mail because:
You are watching all bug changes.
___________________________________________________________________________
Sent via:    Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives:    https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
             mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

Reply via email to