1berry/wireshark
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Falco Events: Maximize the evt field length

Browse Source 
Set the size of the "evt" protocol field to the length of the entire
event.
This commit is contained in:
Gerald Combs 2025-06-21 17:26:26 -07:00
parent 0cfee2f0e1
commit 76f8c0577b
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
plugins/epan/falco_events/packet-falco-events.c
View File

@ -1092,7 +1092,9 @@ dissect_sinsp_enriched(tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree, void
if (!parent_trees[parent_category]) { if (!parent_trees[parent_category]) {
int bytes_offset = 0; int bytes_offset = 0;
uint32_t bytes_length = 0; uint32_t bytes_length = 0;
if (parent_category == SSC_FD) { if (parent_category == SSC_EVENT) {
bytes_length = tvb_captured_length(tvb);
} else if (parent_category == SSC_FD) {
bytes_offset = event_param_data->data_bytes_offset; bytes_offset = event_param_data->data_bytes_offset;
bytes_length = event_param_data->data_bytes_length; bytes_length = event_param_data->data_bytes_length;
} }