["Olivier Biot (Ethereal)" <ethereal@xxxxxxxxxxxxxxx>]

Hi Ronnie,

Thanks for your reply!

Do you mean I can patch proto.c with a mere "if (FT_PROTOCOL) return;" 
statement, like below:

void
proto_item_append_string(proto_item *pi, const char *str)
{
field_info *fi;
header_field_info *hfinfo;
gchar *old_str, *new_str;

if (!pi)
 return;
if (!*str)
 return;

fi = PITEM_FINFO(pi);
hfinfo = fi->hfinfo;
if (hfinfo->type == FT_PROTOCOL) {
 /* TRY_TO_FAKE_THIS_ITEM() speed optimization: silently skip */
 return;
}
DISSECTOR_ASSERT(hfinfo->type == FT_STRING || hfinfo->type == FT_STRINGZ);
old_str = fvalue_get(&fi->value);
new_str = g_strdup_printf("%s%s", old_str, str);
fvalue_set(&fi->value, new_str, TRUE);
}

Or am I missing something here?

Cheers!

Olivier

----- Original Message ----- 
From: ronnie sahlberg

Hmmm.
Maybe the better solution is to change proto_tree_append_string() to be 
"TRY_TO_FAKE_THIS_ITEM aware and thus IF the hf field we try to append to 
happens to be FT_PROTOCOL   then just silently return instead of causing an 
assert.

(FT_PROTOCOL fields are never faked)