[Winpcap-users] pcap_compile leak?

Paul Heil paul.heil at gmail.com
Tue Sep 25 22:52:18 GMT 2007


I have a pcap application that uses a filter (as below). The 15th time I
call pcap_compile(), it fails with the error "too many registers needed to
evaluate expression".
I'm using PCAP v4.0.1 and developer pack 4.0.1.

Is there a call other than pcap_freecode() I should be using to free the
memory allocated in the pcap_compile() command?

int main()
{
//...
    pcap_t *pcapHandle = pcap_open_live( curDev->name, 65536, 1, 1000,
errbuf);
    airHandle = pcap_get_airpcap_handle( pcapHandle );
    PAirpcapHandle AirpcapSetDeviceChannel( airHandle, channel );
    struct bpf_program fcode = { 0 };

    for( int i = 0; i < 15; ++i ) {
        if( pcap_compile( pcapHandle, &fcode, "wlan[0] = 0x80", //beacon
//"wlan[0] = 0xd4", //ack 1, 0xffffff ) < 0 )
        {
            fprintf( stderr, "\n[%d]Filter Error. %s\n", i, pcap_geterr(
pcapHandle ) );
        }
        pcap_freecode( &fcode );
    }
//...
    return 0;
}

>[14]Filter Error. too many registers needed to evaluate expression

Thanks,
Paul
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20070925/73f8415f/attachment.htm


More information about the Winpcap-users mailing list