Comment # 4
on bug 8131
from Guy Harris
(In reply to comment #3)
> (In reply to comment #2)
> Should we add to mass storage dissector
> something like:
> " heur_dissector_add("usb.bulk", dissect_usb_ms_bulk, proto_usb_ms);"?
Something *like* that, yes, but not *exactly* that; it would be more like
heur_dissector_add("usb.bulk", dissect_usb_ms_bulk_heur, proto_usb_ms);
with dissect_usb_ms_bulk_heur() being a routine that returns FALSE if the
tvbuff it's handed has fewer than 4 bytes available to read or if the tvbuff
it's handed has 4 bytes to read but those 4 bytes aren't the signature for a
USB mass storage bulk transfer request, and, otherwise, calls
dissect_usb_ms_bulk() and returns TRUE.
You are receiving this mail because:
- You are watching all bug changes.
