CVE-2017-13038 The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp().

How it was found

Reported to the devs on 11 June 2017. Tcpdump 4.9.2 released on 8 September 2017. Patch: https://github.com/the-tcpdump-group/tcpdump/commit/7335163a6ef82d46ff18f3e6099a157747241629

The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp().

./tcpdump -nr test003
reading from file test003, link-type PPP_ETHER (PPPoE)
=================================================================
==20519==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb5d006f8 at pc 0x082c8c68 bp 0xbf80a208 sp 0xbf80a1fc
READ of size 2 at 0xb5d006f8 thread T0
    #0 0x82c8c67 in EXTRACT_16BITS /root/tcpdump-4.9.0/./extract.h:151:20
    #1 0x82c8c67 in handle_mlppp /root/tcpdump-4.9.0/./print-ppp.c:814
    #2 0x82c8c67 in handle_ppp /root/tcpdump-4.9.0/./print-ppp.c:1462
    #3 0x82c1f87 in ppp_print /root/tcpdump-4.9.0/./print-ppp.c:1566:2
    #4 0x82cb232 in pppoe_print /root/tcpdump-4.9.0/./print-pppoe.c:195:26
    #5 0x82ca729 in pppoe_if_print /root/tcpdump-4.9.0/./print-pppoe.c:90:10
    #6 0x8172ac8 in pretty_print_packet /root/tcpdump-4.9.0/./print.c:339:18
    #7 0x8160678 in print_packet /root/tcpdump-4.9.0/./tcpdump.c:2501:2
    #8 0x843e96b in pcap_offline_read /root/libpcap-1.8.1/./savefile.c:527:4
    #9 0x835973c in pcap_loop /root/libpcap-1.8.1/./pcap.c:890:8
    #10 0x815bd9c in main /root/tcpdump-4.9.0/./tcpdump.c:2004:12
    #11 0xb752f275 in __libc_start_main /build/glibc-4LXvX6/glibc-2.24/csu/../csu/libc-start.c:291
    #12 0x8064dc7 in _start (/root/tcpdump-4.9.0/tcpdump+0x8064dc7)

0xb5d006f9 is located 0 bytes to the right of 9-byte region [0xb5d006f0,0xb5d006f9)
allocated by thread T0 here:
    #0 0x811e994 in malloc (/root/tcpdump-4.9.0/tcpdump+0x811e994)
    #1 0x843fcdc in pcap_check_header /root/libpcap-1.8.1/./sf-pcap.c:401:14
    #2 0x843dc55 in pcap_fopen_offline_with_tstamp_precision /root/libpcap-1.8.1/./savefile.c:400:7
    #3 0x843da38 in pcap_open_offline_with_tstamp_precision /root/libpcap-1.8.1/./savefile.c:307:6

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/tcpdump-4.9.0/./extract.h:151:20 in EXTRACT_16BITS