On Mar 24, 2011, at 1:57 PM, Chris Maynard wrote:
> Or ... convert the dissector to a "new-style" dissector where the number of
> bytes it consumes is returned,
...as long as the dissector cannot validly dissect an empty payload (e.g., an empty reply in a protocol where the request/response matching is done at a protocol layer above that). Some can (I'd have to dig up the ones where they can; I discovered that *years* ago when I was looking at making new-style dissectors the only style and converting all existing dissectors), and the "new-style" dissector interface cannot distinguish between "empty payload" and "this isn't my packet".
If we had an additional type of dissector, which used a ptvcursor, we might be able to have the dissector just return a Boolean accept/reject indication and use the ptvcursor to keep track of how much data was dissected; it would also mean that the offset would be stored in the ptvcursor and the dissector wouldn't have to manually update it, hence no dead-store warnings for the last update....
(If all dissectors worked that way, the only difference between heuristic and non-heuristic dissectors would be whether the dissector ever returned FALSE.)