CVE-2017-13009 The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_print().

How it was found

Reported to the devs on 6 March 2017. Tcpdump 4.9.2 released on 8 September 2017. Patch: https://github.com/the-tcpdump-group/tcpdump/commit/db8c799f6dfc68765c9451fcbfca06e662f5bd5f

The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_print().

./tcpdump -n -r test005

==2606==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000dfff at pc 0x0000005ca779 bp 0x7ffe216cc6f0 sp 0x7ffe216cc6e8
READ of size 1 at 0x60400000dfff thread T0
    #0 0x5ca778 in mobility_print /root/tcpdump/./print-mobility.c:301:7
    #1 0x575edc in ip6_print /root/tcpdump/./print-ip6.c:326:14
    #2 0x57458c in ipN_print /root/tcpdump/./print-ip.c:700:3
    #3 0x626c17 in raw_if_print /root/tcpdump/./print-raw.c:42:2
    #4 0x4de2e9 in pretty_print_packet /root/tcpdump/./print.c:339:18
    #5 0x4cc5fb in print_packet /root/tcpdump/./tcpdump.c:2556:2
    #6 0x773e10 in pcap_offline_read /root/libpcap/./savefile.c:527:4
    #7 0x6a258c in pcap_loop /root/libpcap/./pcap.c:1657:8
    #8 0x4c8a6e in main /root/tcpdump/./tcpdump.c:2059:12
    #9 0x7f0f6ba90b44 in __libc_start_main /build/glibc-qK83Be/glibc-2.19/csu/libc-start.c:287
    #10 0x4c3ccc in _start (/root/tcpdump/tcpdump+0x4c3ccc)

0x60400000dfff is located 0 bytes to the right of 47-byte region [0x60400000dfd0,0x60400000dfff)
allocated by thread T0 here:
    #0 0x4a664b in __interceptor_malloc (/root/tcpdump/tcpdump+0x4a664b)
    #1 0x775763 in pcap_check_header /root/libpcap/./sf-pcap.c:401:14
    #2 0x773472 in pcap_fopen_offline_with_tstamp_precision /root/libpcap/./savefile.c:400:7
    #3 0x773204 in pcap_open_offline_with_tstamp_precision /root/libpcap/./savefile.c:307:6

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/tcpdump/./print-mobility.c:301 mobility_print