On Mar 24, 2011, at 1:57 PM, Chris Maynard wrote: > Or ... convert the dissector to a "new-style" dissector where the number of > bytes it consumes is returned,
...as long as the dissector cannot validly dissect an empty payload (e.g., an empty reply in a protocol where the request/response matching is done at a protocol layer above that). Some can (I'd have to dig up the ones where they can; I discovered that *years* ago when I was looking at making new-style dissectors the only style and converting all existing dissectors), and the "new-style" dissector interface cannot distinguish between "empty payload" and "this isn't my packet". If we had an additional type of dissector, which used a ptvcursor, we might be able to have the dissector just return a Boolean accept/reject indication and use the ptvcursor to keep track of how much data was dissected; it would also mean that the offset would be stored in the ptvcursor and the dissector wouldn't have to manually update it, hence no dead-store warnings for the last update.... (If all dissectors worked that way, the only difference between heuristic and non-heuristic dissectors would be whether the dissector ever returned FALSE.) ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
