Re: After invoking pcap_compile 15 times I get "too many registers needed to evaluate expression"

[Guy Harris <guy () alum mit edu>]

On Oct 24, 2007, at 8:44 AM, Thomas King wrote:

> I use libpcap 0.9.7 as provided by openSuSE 10.3. The problem I face  
> is
> exemplified in the source code I attached to this email. The source  
> code is
> an artificially created example to pin-point the problem I have.  
> Everything
> works create until pcap_compile is invoked the 15th times. As I call
> pcap_freecode at the end of each loop I would assume that the filter  
> memory
> should be freed.

The registers in question aren't filter-memory resources; the BPF  
pseudo-machine has 16 scratch memory locations, and if the code  
generator runs out of scratch memory locations, it fails with that  
error.

> What is wrong with my program? Or is this a bug in libpcap?

It's a bug in libpcap.  I've checked in a fix.  (It should only show  
up if you're capturing from a device that supplies radiotap headers or  
if you're reading from a capture file with radiotap headers.)

BTW, you can (and perhaps should) call pcap_freecode() after calling  
pcap_setfilter() - pcap_setfilter() makes a copy of the filter if  
necessary, so the original filter can be freed.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.