Wireshark · Ethereal-dev: Re: [Ethereal-dev] TRY_TO_FAKE_THIS_ITEM() and proto_item_append_string()

[Guy Harris <gharris@xxxxxxxxx>]

Olivier Biot (Ethereal) wrote:

> As I understand it, the TRY_TO_FAKE_THIS_ITEM() speed optimization has a 
> side effect in that it will only process FT_PROTOCOL fields.  As a
> result, proto_item_append_string() calls may throw a dissector exception 
> if a field to be appended is faked (hence returning the protocol we're 
> in), as only a FT_STRING or FT_STRINGZ can be appended to with this call.

The problem is that, for entries it's faking, it returns its argument, 
which means that, in effect, you end up with a tree that consists only 
of the FT_PROTOCOL item for the protocol being processed.

What if it returned, instead, a special static protocol tree item, and 
proto_item_append_string() just ignored that item, so that incorrect 
attempts to append to an FT_PROTOCOL will still get a dissector error 
reported?