Convert malformed ("protocol") expert infos into something filterable. Not sure if "malformed.expert" is more confusing than helpful, but I didn't want it to share with the "malformed" display filter because their underlying types are different (FT_PROTOCOL vs FT_NONE). The ".expert" has been my convention when a condition already has a well-named hf_ display filter, but also has expert info associated with it.

Also removed the commented out calls to expert_add_info_format to avoid confusion, but left the comments noting the reason it's absent.

svn path=/trunk/; revision=51842

1 files changed, 21 insertions, 11 deletions

diff --git a/epan/show_exception.c b/epan/show_exception.c
index 3948437308..eddcdb755a 100644
--- a/epan/show_exception.c
+++ b/epan/show_exception.c
@@ -34,9 +34,21 @@ static int proto_short = -1;
 static int proto_malformed = -1;
 static int proto_unreassembled = -1;
 
+static expert_field ei_malformed_dissector_bug = EI_INIT;
+static expert_field ei_malformed_reassembly = EI_INIT;
+static expert_field ei_malformed = EI_INIT;
+
 void
 register_show_exception(void)
 {
+	static ei_register_info ei[] = {
+		{ &ei_malformed_dissector_bug, { "malformed.dissector_bug", PI_MALFORMED, PI_ERROR, "Dissector bug", EXPFILL }},
+		{ &ei_malformed_reassembly, { "malformed.reassembly", PI_MALFORMED, PI_ERROR, "Reassembly error", EXPFILL }},
+		{ &ei_malformed, { "malformed.expert", PI_MALFORMED, PI_ERROR, "Malformed Packet (Exception occurred)", EXPFILL }},
+	};
+
+	expert_module_t* expert_malformed;
+
 	proto_short = proto_register_protocol("Short Frame", "Short frame", "short");
 	proto_malformed = proto_register_protocol("Malformed Packet",
 	    "Malformed packet", "malformed");
@@ -44,6 +56,9 @@ register_show_exception(void)
 	    "Unreassembled Fragmented Packet",
 	    "Unreassembled fragmented packet", "unreassembled");
 
+	expert_malformed = expert_register_protocol(proto_malformed);
+	expert_register_field_array(expert_malformed, ei, array_length(ei));
+
 	/* "Short Frame", "Malformed Packet", and "Unreassembled Fragmented
 	   Packet" aren't really protocols, they're error indications;
 	   disabling them makes no sense. */
@@ -67,34 +82,31 @@ show_exception(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
 
 	case ScsiBoundsError:
 		col_append_str(pinfo->cinfo, COL_INFO, "[SCSI transfer limited due to allocation_length too small]");
-		/*item =*/ proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0,
+		proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0,
 				"SCSI transfer limited due to allocation_length too small: %s truncated]", pinfo->current_proto);
 		/* Don't record ScsiBoundsError exceptions as expert events - they merely
 		 * reflect a normal SCSI condition.
 		 * (any case where it's caused by something else is a bug). */
-		/* expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "Packet size limited");*/
 		break;
 
 	case BoundsError:
 		col_append_str(pinfo->cinfo, COL_INFO, "[Packet size limited during capture]");
-		/*item =*/ proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0,
+		proto_tree_add_protocol_format(tree, proto_short, tvb, 0, 0,
 				"[Packet size limited during capture: %s truncated]", pinfo->current_proto);
 		/* Don't record BoundsError exceptions as expert events - they merely
 		 * reflect a capture done with a snapshot length too short to capture
 		 * all of the packet
 		 * (any case where it's caused by something else is a bug). */
-		/* expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "Packet size limited");*/
 		break;
 
 	case FragmentBoundsError:
 		col_append_fstr(pinfo->cinfo, COL_INFO, "[Unreassembled Packet%s]", pinfo->noreassembly_reason);
-		/*item =*/ proto_tree_add_protocol_format(tree, proto_unreassembled,
+		proto_tree_add_protocol_format(tree, proto_unreassembled,
 		    tvb, 0, 0, "[Unreassembled Packet%s: %s]",
 		    pinfo->noreassembly_reason, pinfo->current_proto);
 		/* Don't record FragmentBoundsError exceptions as expert events - they merely
 		 * reflect dissection done with reassembly turned off
 		 * (any case where it's caused by something else is a bug). */
-		/* expert_add_info_format(pinfo, item, PI_REASSEMBLE, PI_WARN, "Unreassembled Packet (Exception occured)");*/
 		break;
 
 	case ReportedBoundsError:
@@ -116,8 +128,7 @@ show_exception(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
 		    pinfo->current_proto, pinfo->fd->num,
 		    exception_message == NULL ?
 		        dissector_error_nomsg : exception_message);
-		expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR,
-		    "%s",
+		expert_add_info_format_text(pinfo, item, &ei_malformed_dissector_bug, "%s",
 		    exception_message == NULL ?
 		        dissector_error_nomsg : exception_message);
 		break;
@@ -133,8 +144,7 @@ show_exception(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
 		    pinfo->current_proto,
 		    exception_message == NULL ?
 		        dissector_error_nomsg : exception_message);
-		expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR,
-		    "%s",
+		expert_add_info_format_text(pinfo, item, &ei_malformed_reassembly, "%s",
 		    exception_message == NULL ?
 		        dissector_error_nomsg : exception_message);
 		break;
@@ -154,5 +164,5 @@ show_reported_bounds_error(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 	    "[Malformed Packet]");
 	item = proto_tree_add_protocol_format(tree, proto_malformed,
 	    tvb, 0, 0, "[Malformed Packet: %s]", pinfo->current_proto);
-	expert_add_info_format(pinfo, item, PI_MALFORMED, PI_ERROR, "Malformed Packet (Exception occurred)");
+	expert_add_info(pinfo, item, &ei_malformed);
 }