func:  PIDL_dissect_policy_hnd(tvbuff_t *tvb, gint offset, packet_info proto_tree *tree, dcerpc_info* di, guint8 *drep, int guint32 param) offset = dissect_nt_hnd ( tvb , offset , pinfo , tree , di , drep , hfindex , & policy_hnd , NULL , param & PIDL_POLHND_OPEN , param & PIDL_POLHND_CLOSE , HND_TYPE_CTX_HANDLE ); static dissect_nt_hnd(tvbuff_t *tvb, gint offset, packet_info proto_tree *tree, dcerpc_info *di, guint8 *drep, int e_ctx_hnd *pdata, proto_item gboolean is_open, gboolean is_close, e_hnd_type type) e_ctx_hnd hnd ; if ( di -> conformant_run )  switch ( type )  hnd . attributes = 0; dcerpc_smb_store_pol_pkts ( & hnd , pinfo , is_open , is_close ); void dcerpc_smb_store_pol_pkts(e_ctx_hnd *policy_hnd, packet_info gboolean is_open, gboolean is_close) pol_hash_value * value ; pol_value * pol ; if ( pinfo -> fd -> flags . visited )  if ( is_null_pol ( policy_hnd ) )  pol = find_pol_handle ( policy_hnd , pinfo -> fd -> num , & value ); if ( pol != NULL )  if ( is_open )  if ( pol -> first_frame == pinfo -> fd -> num && pol -> last_frame == 0 )  pol = ( pol_value * ) wmem_alloc ( wmem_file_scope ( ) , sizeof ( pol_value ) ); pol -> open_frame = is_open ? pinfo -> fd -> num : 0; pol -> close_frame = is_close ? pinfo -> fd -> num : 0; pol -> first_frame = pinfo -> fd -> num; pol -> last_frame = pol -> close_frame; pol -> type = 0; pol -> name = NULL; add_pol_handle ( policy_hnd , pinfo -> fd -> num , pol , value ); static void add_pol_handle(e_ctx_hnd *policy_hnd, guint32 pol_value *pol, pol_hash_value *value) pol_hash_key * key ; if ( value == NULL )  key = ( pol_hash_key * ) wmem_alloc ( wmem_file_scope ( ) , sizeof ( pol_hash_key ) ); memcpy ( & key -> policy_hnd , policy_hnd , sizeof ( key -> policy_hnd ) ); g_hash_table_insert ( pol_hash , key , value ); 