dfilter: Fix protocol slices with negative indexes

Field infos have a length property that was not stored with the
field value so when using a negative index the end was computed
from the captured length of the frame tvbuff, leading to incorrect
results. The documentation in wireshark-filter(5) describes how
this was supposed to work but as far as I can tell it never worked
properly.

We now store the length and use that (when it is different from -1)
to locate the end of the protocol data in the tvbuff. An extra wrinkle
is that sometimes the length is set after the field value is created.
This is the most common case as the majority of protocols have a
variable length and dissection generally proceeds with a TVB subset from
the current layer (with offset zero) through all remaining layers to the
end of the captured length. For that reason we must use an expedient to allow
changing the protocol length of an existing protocol fvalue, whenever
proto_item_set_len() is called.

Fixes #17772.

1 files changed, 5 insertions, 1 deletions

diff --git a/test/suite_dfilter/group_range_method.py b/test/suite_dfilter/group_range_method.py
index e1df57f40c..143b223cd0 100644
--- a/test/suite_dfilter/group_range_method.py
+++ b/test/suite_dfilter/group_range_method.py
@@ -15,10 +15,14 @@ class case_range(unittest.TestCase):
         dfilter = "ipx.src.node[1] == aa"
         checkDFilterCount(dfilter, 1)
 
-    def test_slice_1_neg(self, checkDFilterCount):
+    def test_slice_2_pos(self, checkDFilterCount):
         dfilter = "ipx.src.node[1] == bb"
         checkDFilterCount(dfilter, 0)
 
+    def test_slice_1_neg(self, checkDFilterCount):
+        dfilter = "ipx[-2:] == 04:53"
+        checkDFilterCount(dfilter, 1)
+
     def test_slice_1_hex_pos(self, checkDFilterCount):
         dfilter = "ipx.src.node[1] == 0xaa"
         checkDFilterCount(dfilter, 1)