[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 4 on bug 8131 from Guy Harris

(In reply to comment #3)
> (In reply to comment #2)
> Should we add to mass storage dissector
> something like:
> "    heur_dissector_add("usb.bulk", dissect_usb_ms_bulk, proto_usb_ms);"?

Something *like* that, yes, but not *exactly* that; it would be more like

    heur_dissector_add("usb.bulk", dissect_usb_ms_bulk_heur, proto_usb_ms);

with dissect_usb_ms_bulk_heur() being a routine that returns FALSE if the
tvbuff it's handed has fewer than 4 bytes available to read or if the tvbuff
it's handed has 4 bytes to read but those 4 bytes aren't the signature for a
USB mass storage bulk transfer request, and, otherwise, calls
dissect_usb_ms_bulk() and returns TRUE.

---

      You are receiving this mail because:

• You are watching all bug changes.