tcpdump/tests/getname_2_read4_asan.out
Guy Harris 13ab8d1861 CVE-2017-13013/ARP: Fix printing of ARP protocol addresses.
If the protocol type isn't ETHERTYPE_IP or ETHERTYPE_TRAIL, or if the
protocol address length isn't 4, don't print the address as an IPv4 address.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.

Update another test file's tcpdump output to reflect this change.
2017-09-13 12:25:44 +01:00

2 lines
132 B
Plaintext

ARP, Unknown Hardware (65280) (len 0), Unknown Protocol (0x8b01) (len 0), Reverse Reply <empty> at <wrong proto type>, length 65556