Wireshark · Ethereal-dev: Re: [Ethereal-dev] TRY_TO_FAKE_THIS_ITEM() and proto_item_append_string()

["Olivier Biot (Ethereal)" <ethereal@xxxxxxxxxxxxxxx>]

From: Guy Harris


> Olivier Biot (Ethereal) wrote:
>
> > As I understand it, the TRY_TO_FAKE_THIS_ITEM() speed optimization has a 
> > side effect in that it will only process FT_PROTOCOL fields.  As a
> > result, proto_item_append_string() calls may throw a dissector exception 
> > if a field to be appended is faked (hence returning the protocol we're 
> > in), as only a FT_STRING or FT_STRINGZ can be appended to with this call.
>
> The problem is that, for entries it's faking, it returns its argument, 
> which means that, in effect, you end up with a tree that consists only of 
> the FT_PROTOCOL item for the protocol being processed.
>
> What if it returned, instead, a special static protocol tree item, and 
> proto_item_append_string() just ignored that item, so that incorrect 
> attempts to append to an FT_PROTOCOL will still get a dissector error 
> reported?

That's an interesting idea. Instead of silently discarding the update with a 
test on FT_PROTOCOL only, you'd propose a more elaborate test with this 
static tree item. I'd favor your proposed approach (however I won't mess 
around in the TRY_TO_FAKE_THIS_ITEM() macro, though :)

Best regards,

Olivier