dfilter: Tweak representation for length-1 byte array

Make dfilter byte representation always use ':' for consistency.

Make 1 byte be represented as "XX:" with the colon suffix to
make it nonambiguous that is is a byte and not other type,
like a protocol.

The difference is can be seen in the following programs. In the
before representation it is not obvious at all that the second
"fc" value is a literal bytes value and not the value of the
protocol "fc", although it can be inferred from the lack of
a READ_TREE instruction. In the After we know that "fc:" must
be bytes and not a protocol.

Note that a leading colon is a syntactical expedient to say
"this value with any type is a literal value and not a protocol
field." A terminating colon is just a part of the dfilter
literal bytes syntax.

Before:

Filter: fc == :fc

Syntax tree:
 0 TEST_ANY_EQ:
   1 FIELD(fc <FT_PROTOCOL>)
   1 FVALUE(fc <FT_PROTOCOL>)

Instructions:
00000 READ_TREE		fc <FT_PROTOCOL> -> reg#0
00001 IF_FALSE_GOTO	3
00002 ANY_EQ		reg#0 == fc <FT_PROTOCOL>

After:

Filter: fc == :fc

Syntax tree:
 0 TEST_ANY_EQ:
   1 FIELD(fc <FT_PROTOCOL>)
   1 FVALUE(fc: <FT_PROTOCOL>)

Instructions:
00000 READ_TREE		fc <FT_PROTOCOL> -> reg#0
00001 IF_FALSE_GOTO	3
00002 ANY_EQ		reg#0 == fc: <FT_PROTOCOL>

1 files changed, 27 insertions, 5 deletions

diff --git a/epan/ftypes/ftype-bytes.c b/epan/ftypes/ftype-bytes.c
index 719bae0f25..d3771f519c 100644
--- a/epan/ftypes/ftype-bytes.c
+++ b/epan/ftypes/ftype-bytes.c
@@ -69,11 +69,38 @@ system_id_to_repr(wmem_allocator_t *scope, const fvalue_t *fv, ftrepr_t rtype _U
 	return print_system_id(scope, fv->value.bytes->data, fv->value.bytes->len);
 }
 
+char *
+bytes_to_dfilter_repr(wmem_allocator_t *scope,
+			const guint8 *src, size_t src_size)
+{
+	char *buf;
+	size_t max_char_size;
+	char *buf_ptr;
+
+	/* Include space for extra punct and '\0'. */
+	max_char_size = src_size * 3 + 1;
+
+	buf = wmem_alloc(scope, max_char_size);
+	buf_ptr = bytes_to_hexstr_punct(buf, src, src_size, ':');
+	if (src_size == 1)
+		*buf_ptr++ = ':';
+	*buf_ptr = '\0';
+	return buf;
+}
+
 static char *
 bytes_to_repr(wmem_allocator_t *scope, const fvalue_t *fv, ftrepr_t rtype, int field_display)
 {
 	char separator;
 
+	if (rtype == FTREPR_DFILTER) {
+		if (fv->value.bytes->len == 0) {
+			/* An empty byte array in a display filter is represented as "" */
+			return wmem_strdup(scope, "\"\"");
+		}
+		return bytes_to_dfilter_repr(scope, fv->value.bytes->data, fv->value.bytes->len);
+	}
+
 	switch(FIELD_DISPLAY(field_display))
 	{
 	case SEP_DOT:
@@ -94,11 +121,6 @@ bytes_to_repr(wmem_allocator_t *scope, const fvalue_t *fv, ftrepr_t rtype, int f
 		return bytes_to_str_punct_maxlen(scope, fv->value.bytes->data, fv->value.bytes->len, separator, 0);
 	}
 
-	if (rtype == FTREPR_DFILTER) {
-		/* An empty byte array in a display filter is represented as "" */
-		return wmem_strdup(scope, "\"\"");
-	}
-
 	return wmem_strdup(scope, "");
 }