Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-12896: Out-of-bounds Read (CWE-125)
value: The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:isakmp_rfc3948_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: tests/TESTLIST, tests/isakmp-3948-oobr-2.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-12896/ISAKMP: Add another test.

This is from Brian Carpenter for the print-isakmp bug fix.

Diff: diff --git a/tests/TESTLIST b/tests/TESTLIST
index 9e7b0796e..8ae610995 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -435,10 +435,11 @@ atm-heapoverflow	atm-heapoverflow.pcap		atm-heapoverflow.out		-c1 -e
 ipv6-next-header-oobr-1	ipv6-next-header-oobr-1.pcap	ipv6-next-header-oobr-1.out
 ipv6-next-header-oobr-2	ipv6-next-header-oobr-2.pcap	ipv6-next-header-oobr-2.out
 ipv6-rthdr-oobr		ipv6-rthdr-oobr.pcap		ipv6-rthdr-oobr.out
 ieee802.11_tim_ie_oobr	ieee802.11_tim_ie_oobr.pcap	ieee802.11_tim_ie_oobr.out
 decnet-shorthdr-oobr	decnet-shorthdr-oobr.pcap	decnet-shorthdr-oobr.out
+isakmp-3948-oobr-2	isakmp-3948-oobr-2.pcap		isakmp-3948-oobr-2.out
 
 # bad packets from Kamil Frankowicz
 snmp-heapoverflow-1	snmp-heapoverflow-1.pcap	snmp-heapoverflow-1.out
 snmp-heapoverflow-2	snmp-heapoverflow-2.pcap	snmp-heapoverflow-2.out
 isoclns-heapoverflow-2	isoclns-heapoverflow-2.pcap	isoclns-heapoverflow-2.out	-e -c1
diff --git a/tests/isakmp-3948-oobr-2.out b/tests/isakmp-3948-oobr-2.out
new file mode 100644
index 000000000..cad5686ca
--- /dev/null
+++ b/tests/isakmp-3948-oobr-2.out
@@ -0,0 +1 @@
+IP 48.48.48.48.4500 > 48.48.48.48.12336: [|isakmp]
diff --git a/tests/isakmp-3948-oobr-2.pcap b/tests/isakmp-3948-oobr-2.pcap
new file mode 100644
index 000000000..fbea5a9ad
Binary files /dev/null and b/tests/isakmp-3948-oobr-2.pcap differ

Fixed code: isakmp-3948-oobr-2	isakmp-3948-oobr-2.pcap		isakmp-3948-oobr-2.out
IP 48.48.48.48.4500 > 48.48.48.48.12336: [|isakmp]
CVE-2017-12902: Out-of-bounds Read (CWE-125)
value: The Zephyr parser in tcpdump before 4.9.2 has a buffer over-read in print-zephyr.c, several functions.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: tests/TESTLIST, tests/hoobr_parse_field.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-12902/Zephyr: Add an additional test.

File from Kamil Frankowicz.

Diff: diff --git a/tests/TESTLIST b/tests/TESTLIST
index f14868fc4..7b841e991 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -452,10 +452,11 @@ decnet-oobr		decnet-oobr.pcap		decnet-oobr.out
 oobr_parse_elements	oobr_parse_elements.pcap	oobr_parse_elements.out
 hoobr_ripng_print	hoobr_ripng_print.pcap		hoobr_ripng_print.out
 hoobr_juniper		hoobr_juniper.pcap		hoobr_juniper.out
 hoobr_juniper2		hoobr_juniper2.pcap		hoobr_juniper2.out
 hoobr_juniper3		hoobr_juniper3.pcap		hoobr_juniper3.out
+hoobr_parse_field	hoobr_parse_field.pcap		hoobr_parse_field.out
 
 # bad packets from Wilfried Kirsch
 slip-bad-direction	slip-bad-direction.pcap		slip-bad-direction.out	-ve
 
 # bad packets from Otto Airamo and Antti Levomäki
diff --git a/tests/hoobr_parse_field.out b/tests/hoobr_parse_field.out
new file mode 100644
index 000000000..2eecd7379
--- /dev/null
+++ b/tests/hoobr_parse_field.out
@@ -0,0 +1,5 @@
+30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
+	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
+	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
+	0x0020:  3030                                     00
+IP 48.48.48.48.2104 > 48.48.48.48.12336:  [|zephyr] (12308)
diff --git a/tests/hoobr_parse_field.pcap b/tests/hoobr_parse_field.pcap
new file mode 100644
index 000000000..f76d6282a
Binary files /dev/null and b/tests/hoobr_parse_field.pcap differ

Fixed code: hoobr_parse_field	hoobr_parse_field.pcap		hoobr_parse_field.out
30:30:30:30:30:30 > 30:30:30:30:30:30, ethertype Unknown (0x3030), length 808464432: 
	0x0000:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0010:  3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
	0x0020:  3030                                     00
IP 48.48.48.48.2104 > 48.48.48.48.12336:  [|zephyr] (12308)
CVE-2017-12987: Out-of-bounds Read (CWE-125)
value: The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-802_11.c, tests/TESTLIST, tests/ieee802.11_tim_ie_oobr.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-12987/IEEE 802.11: Fix processing of TIM IE.

The arguments to memcpy() were completely wrong.

This fixes a buffer over-read discovered by Kamil Frankowicz.

Add a test using the capture file supplied by Brian 'geeknik' Carpenter.

Diff: diff --git a/print-802_11.c b/print-802_11.c
index 1bbe47ace..17c1f70cb 100644
--- a/print-802_11.c
+++ b/print-802_11.c
@@ -1187,12 +1187,11 @@ parse_elements(netdissect_options *ndo,
 				return 0;
 			memcpy(&tim.count, p + offset, 3);
 			offset += 3;
 			length -= 3;
 
-			memcpy(tim.bitmap, p + (tim.length - 3),
-			    (tim.length - 3));
+			memcpy(tim.bitmap, p + offset + 3, tim.length - 3);
 			offset += tim.length - 3;
 			length -= tim.length - 3;
 			/*
 			 * Present and not truncated.
 			 *
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 0829e90d2..bfd58991d 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -433,10 +433,11 @@ otv-heapoverflow-2	otv-heapoverflow-2.pcap		otv-heapoverflow-2.out		-c10
 q933-heapoverflow-2	q933-heapoverflow-2.pcap	q933-heapoverflow-2.out
 atm-heapoverflow	atm-heapoverflow.pcap		atm-heapoverflow.out		-c1 -e
 ipv6-next-header-oobr-1	ipv6-next-header-oobr-1.pcap	ipv6-next-header-oobr-1.out
 ipv6-next-header-oobr-2	ipv6-next-header-oobr-2.pcap	ipv6-next-header-oobr-2.out
 ipv6-rthdr-oobr		ipv6-rthdr-oobr.pcap		ipv6-rthdr-oobr.out
+ieee802.11_tim_ie_oobr	ieee802.11_tim_ie_oobr.pcap	ieee802.11_tim_ie_oobr.out
 
 # bad packets from Kamil Frankowicz
 snmp-heapoverflow-1	snmp-heapoverflow-1.pcap	snmp-heapoverflow-1.out
 snmp-heapoverflow-2	snmp-heapoverflow-2.pcap	snmp-heapoverflow-2.out
 isoclns-heapoverflow-2	isoclns-heapoverflow-2.pcap	isoclns-heapoverflow-2.out	-e -c1
diff --git a/tests/ieee802.11_tim_ie_oobr.out b/tests/ieee802.11_tim_ie_oobr.out
new file mode 100644
index 000000000..526868371
--- /dev/null
+++ b/tests/ieee802.11_tim_ie_oobr.out
@@ -0,0 +1,4 @@
+ReAssoc Response AID(3030) : PRIVACY : n/a[|802.11]
+ReAssoc Response AID(3030) : PRIVACY : n/a[|802.11]
+[|802.11]
+ReAssoc Response AID(3030) : PRIVACY : n/a[|802.11]
diff --git a/tests/ieee802.11_tim_ie_oobr.pcap b/tests/ieee802.11_tim_ie_oobr.pcap
new file mode 100644
index 000000000..bb05c81f7
Binary files /dev/null and b/tests/ieee802.11_tim_ie_oobr.pcap differ

Vulnerable code: 			memcpy(tim.bitmap, p + (tim.length - 3),
			    (tim.length - 3));
Fixed code: 			memcpy(tim.bitmap, p + offset + 3, tim.length - 3);
ieee802.11_tim_ie_oobr	ieee802.11_tim_ie_oobr.pcap	ieee802.11_tim_ie_oobr.out
ReAssoc Response AID(3030) : PRIVACY : n/a[|802.11]
ReAssoc Response AID(3030) : PRIVACY : n/a[|802.11]
[|802.11]
ReAssoc Response AID(3030) : PRIVACY : n/a[|802.11]
CVE-2017-12987: Out-of-bounds Read (CWE-125)
value: The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: tests/TESTLIST, tests/oobr_parse_elements.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-12987/Another test for the TIM IE bug, from Kamil Frankowicz.

Diff: diff --git a/tests/TESTLIST b/tests/TESTLIST
index 61264ee2e..e0f0bb146 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -447,10 +447,11 @@ hoobr_pimv1		hoobr_pimv1.pcap		hoobr_pimv1.out
 hoobr_safeputs		hoobr_safeputs.pcap		hoobr_safeputs.out
 isakmp-rfc3948-oobr	isakmp-rfc3948-oobr.pcap	isakmp-rfc3948-oobr.out
 isoclns-oobr		isoclns-oobr.pcap		isoclns-oobr.out
 nfs-attr-oobr		nfs-attr-oobr.pcap		nfs-attr-oobr.out
 decnet-oobr		decnet-oobr.pcap		decnet-oobr.out
+oobr_parse_elements	oobr_parse_elements.pcap	oobr_parse_elements.out
 
 # bad packets from Wilfried Kirsch
 slip-bad-direction	slip-bad-direction.pcap		slip-bad-direction.out	-ve
 
 # bad packets from Otto Airamo and Antti Levomäki
diff --git a/tests/oobr_parse_elements.out b/tests/oobr_parse_elements.out
new file mode 100644
index 000000000..b09ed73b1
--- /dev/null
+++ b/tests/oobr_parse_elements.out
@@ -0,0 +1 @@
+Beacon IBSS, PRIVACY[|802.11]
diff --git a/tests/oobr_parse_elements.pcap b/tests/oobr_parse_elements.pcap
new file mode 100644
index 000000000..16d8848ec
Binary files /dev/null and b/tests/oobr_parse_elements.pcap differ

Fixed code: oobr_parse_elements	oobr_parse_elements.pcap	oobr_parse_elements.out
Beacon IBSS, PRIVACY[|802.11]
CVE-2017-13000: Out-of-bounds Read (CWE-125)
value: The IEEE 802.15.4 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_15_4.c:ieee802_15_4_if_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-802_15_4.c, tests/802_15_4-data.out, tests/TESTLIST
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13000/IEEE 802.15.4: Fix bug introduced by previous fix.

We've already advanced the pointer past the PAN ID, if present; it now
points to the address, so don't add 2 to it.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add a test using the capture file supplied by the reporter(s).

Diff: diff --git a/print-802_15_4.c b/print-802_15_4.c
index a43d0333c..a7817eb5a 100644
--- a/print-802_15_4.c
+++ b/print-802_15_4.c
@@ -139,11 +139,11 @@ ieee802_15_4_if_print(netdissect_options *ndo,
 		if (caplen < 8) {
 			ND_PRINT((ndo, "[|802.15.4]"));
 			return hdrlen;
 		}
 		if (ndo->ndo_vflag)
-			ND_PRINT((ndo,"%04x:%s ", panid, le64addr_string(ndo, p + 2)));
+			ND_PRINT((ndo,"%04x:%s ", panid, le64addr_string(ndo, p)));
 		p += 8;
 		caplen -= 8;
 		hdrlen += 8;
 		break;
 	}
diff --git a/tests/802_15_4-data.out b/tests/802_15_4-data.out
new file mode 100644
index 000000000..0e646751c
--- /dev/null
+++ b/tests/802_15_4-data.out
@@ -0,0 +1 @@
+IEEE 802.15.4 Data packet seq 01 ab4d:10:05:00:81:00:01:00:01 < [|802.15.4]
diff --git a/tests/802_15_4-data.pcap b/tests/802_15_4-data.pcap
new file mode 100644
index 000000000..4a32784e2
Binary files /dev/null and b/tests/802_15_4-data.pcap differ
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 491af396e..be914a4a9 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -486,10 +486,11 @@ pimv2-oobr-1		pimv2-oobr-1.pcap		pimv2-oobr-1.out		-vvv -e
 pimv2-oobr-2		pimv2-oobr-2.pcap		pimv2-oobr-2.out		-vvv -e
 pimv2-oobr-3		pimv2-oobr-3.pcap		pimv2-oobr-3.out		-vvv -e
 pimv2-oobr-4		pimv2-oobr-4.pcap		pimv2-oobr-4.out		-vvv -e
 802_15_4-oobr-1		802_15_4-oobr-1.pcap		802_15_4-oobr-1.out	-vvv -e
 802_15_4-oobr-2		802_15_4-oobr-2.pcap		802_15_4-oobr-2.out	-vvv -e
+802_15_4-data		802_15_4-data.pcap		802_15_4-data.out	-vvv -e
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp

Vulnerable code: 			ND_PRINT((ndo,"%04x:%s ", panid, le64addr_string(ndo, p + 2)));
Fixed code: 			ND_PRINT((ndo,"%04x:%s ", panid, le64addr_string(ndo, p)));
IEEE 802.15.4 Data packet seq 01 ab4d:10:05:00:81:00:01:00:01 < [|802.15.4]
802_15_4-data		802_15_4-data.pcap		802_15_4-data.out	-vvv -e
CVE-2017-13000: Out-of-bounds Read (CWE-125)
value: The IEEE 802.15.4 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_15_4.c:ieee802_15_4_if_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-802_15_4.c, tests/802_15_4_beacon.out, tests/TESTLIST
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13000/IEEE 802.15.4: Fix bug introduced two fixes prior.

We've already advanced the pointer past the PAN ID, if present; it now
points to the address, so don't add 2 to it.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add a test using the capture file supplied by the reporter(s).

Diff: diff --git a/print-802_15_4.c b/print-802_15_4.c
index a7817eb5a..1c77da8af 100644
--- a/print-802_15_4.c
+++ b/print-802_15_4.c
@@ -120,11 +120,11 @@ ieee802_15_4_if_print(netdissect_options *ndo,
 		if (caplen < 2) {
 			ND_PRINT((ndo, "[|802.15.4]"));
 			return hdrlen;
 		}
 		if (ndo->ndo_vflag)
-			ND_PRINT((ndo,"%04x:%04x ", panid, EXTRACT_LE_16BITS(p + 2)));
+			ND_PRINT((ndo,"%04x:%04x ", panid, EXTRACT_LE_16BITS(p)));
 		p += 2;
 		caplen -= 2;
 		hdrlen += 2;
 		break;
 	case FC_ADDRESSING_MODE_LONG:
diff --git a/tests/802_15_4_beacon.out b/tests/802_15_4_beacon.out
new file mode 100644
index 000000000..125f46d5c
--- /dev/null
+++ b/tests/802_15_4_beacon.out
@@ -0,0 +1 @@
+IEEE 802.15.4 Beacon packet seq cd ffab:cdff < [|802.15.4]
diff --git a/tests/802_15_4_beacon.pcap b/tests/802_15_4_beacon.pcap
new file mode 100644
index 000000000..9e6aafe1d
Binary files /dev/null and b/tests/802_15_4_beacon.pcap differ
diff --git a/tests/TESTLIST b/tests/TESTLIST
index be914a4a9..548af8f30 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -487,10 +487,11 @@ pimv2-oobr-2		pimv2-oobr-2.pcap		pimv2-oobr-2.out		-vvv -e
 pimv2-oobr-3		pimv2-oobr-3.pcap		pimv2-oobr-3.out		-vvv -e
 pimv2-oobr-4		pimv2-oobr-4.pcap		pimv2-oobr-4.out		-vvv -e
 802_15_4-oobr-1		802_15_4-oobr-1.pcap		802_15_4-oobr-1.out	-vvv -e
 802_15_4-oobr-2		802_15_4-oobr-2.pcap		802_15_4-oobr-2.out	-vvv -e
 802_15_4-data		802_15_4-data.pcap		802_15_4-data.out	-vvv -e
+802_15_4_beacon		802_15_4_beacon.pcap		802_15_4_beacon.out	-vvv -e
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp

Vulnerable code: 			ND_PRINT((ndo,"%04x:%04x ", panid, EXTRACT_LE_16BITS(p + 2)));
Fixed code: 			ND_PRINT((ndo,"%04x:%04x ", panid, EXTRACT_LE_16BITS(p)));
IEEE 802.15.4 Beacon packet seq cd ffab:cdff < [|802.15.4]
802_15_4_beacon		802_15_4_beacon.pcap		802_15_4_beacon.out	-vvv -e
CVE-2017-13004: Out-of-bounds Read (CWE-125)
value: The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c:juniper_parse_header().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: tests/TESTLIST, tests/hoobr_juniper4.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13004/Juniper: Add a capture file.

File from Kamil Frankowicz testing an existing fix.

(Same problem, and same fix, as the recent Juniper fixes.)

Diff: diff --git a/tests/TESTLIST b/tests/TESTLIST
index c0a3f8dd8..9ea944d48 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -452,10 +452,11 @@ decnet-oobr		decnet-oobr.pcap		decnet-oobr.out
 oobr_parse_elements	oobr_parse_elements.pcap	oobr_parse_elements.out
 hoobr_ripng_print	hoobr_ripng_print.pcap		hoobr_ripng_print.out
 hoobr_juniper		hoobr_juniper.pcap		hoobr_juniper.out
 hoobr_juniper2		hoobr_juniper2.pcap		hoobr_juniper2.out
 hoobr_juniper3		hoobr_juniper3.pcap		hoobr_juniper3.out
+hoobr_juniper4		hoobr_juniper4.pcap		hoobr_juniper4.out
 hoobr_parse_field	hoobr_parse_field.pcap		hoobr_parse_field.out
 hoobr_chdlc_print	hoobr_chdlc_print.pcap		hoobr_chdlc_print.out
 hoobr_lookup_nsap	hoobr_lookup_nsap.pcap		hoobr_lookup_nsap.out
 hoobr_rt6_print		hoobr_rt6_print.pcap		hoobr_rt6_print.out
 hoobr_nfs_printfh	hoobr_nfs_printfh.pcap		hoobr_nfs_printfh.out
diff --git a/tests/hoobr_juniper4.out b/tests/hoobr_juniper4.out
new file mode 100644
index 000000000..b13cfbee0
--- /dev/null
+++ b/tests/hoobr_juniper4.out
@@ -0,0 +1 @@
+[|juniper_hdr], length 808464432
diff --git a/tests/hoobr_juniper4.pcap b/tests/hoobr_juniper4.pcap
new file mode 100644
index 000000000..3019e870e
Binary files /dev/null and b/tests/hoobr_juniper4.pcap differ

Fixed code: hoobr_juniper4		hoobr_juniper4.pcap		hoobr_juniper4.out
[|juniper_hdr], length 808464432
CVE-2017-13012: Out-of-bounds Read (CWE-125)
value: The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-icmp.c, tests/TESTLIST, tests/extract_read2_asan.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13012/ICMP: Add a missing bounds check.

Check before fetching the length from the included packet's IPv4 header.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.

Diff: diff --git a/print-icmp.c b/print-icmp.c
index ec7525357f..366094eff8 100644
--- a/print-icmp.c
+++ b/print-icmp.c
@@ -579,10 +579,11 @@ icmp_print(netdissect_options *ndo, const u_char *bp, u_int plen, const u_char *
 	if (ndo->ndo_vflag >= 1 && ICMP_ERRTYPE(dp->icmp_type)) {
 		bp += 8;
 		ND_PRINT((ndo, "\n\t"));
 		ip = (const struct ip *)bp;
                 snapend_save = ndo->ndo_snapend;
+		ND_TCHECK_16BITS(&ip->ip_len);
 		ip_print(ndo, bp, EXTRACT_16BITS(&ip->ip_len));
                 ndo->ndo_snapend = snapend_save;
 	}
 
         /*
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 309e896f5f..2fb4d46fa7 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -507,10 +507,11 @@ juniper_es		juniper_es.pcap			juniper_es.out	-vvv -e
 l2tp-avp-overflow	l2tp-avp-overflow.pcap		l2tp-avp-overflow.out	-v
 pktap-heap-overflow	pktap-heap-overflow.pcap	pktap-heap-overflow.out	-v
 
 # bad packets from Bhargava Shastry
 lldp_asan		lldp_asan.pcap			lldp_asan.out	-v
+extract_read2_asan	extract_read2_asan.pcap		extract_read2_asan.out	-v
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
diff --git a/tests/extract_read2_asan.out b/tests/extract_read2_asan.out
new file mode 100644
index 0000000000..d0b72ed0e4
--- /dev/null
+++ b/tests/extract_read2_asan.out
@@ -0,0 +1,3 @@
+IP (tos 0x14, id 1, offset 0, flags [none], proto ICMP (1), length 512, options (unknown 3,unknown 3,unknown 3 [bad length 3]), bad cksum 3ff (->b4bd)!)
+    240.25.0.0 > 3.3.3.3: ICMP source quench, length 484
+	[|icmp]
diff --git a/tests/extract_read2_asan.pcap b/tests/extract_read2_asan.pcap
new file mode 100644
index 0000000000..d30ee16ddb
Binary files /dev/null and b/tests/extract_read2_asan.pcap differ

Fixed code: 		ND_TCHECK_16BITS(&ip->ip_len);
extract_read2_asan	extract_read2_asan.pcap		extract_read2_asan.out	-v
IP (tos 0x14, id 1, offset 0, flags [none], proto ICMP (1), length 512, options (unknown 3,unknown 3,unknown 3 [bad length 3]), bad cksum 3ff (->b4bd)!)
    240.25.0.0 > 3.3.3.3: ICMP source quench, length 484
	[|icmp]
CVE-2017-13020: Out-of-bounds Read (CWE-125)
value: The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: tests/TESTLIST, tests/vtp_asan-2.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13020/VTP: Add another test.

A capture file supplied by Bhargava Shastry, modified so the capture
file won't be rejected as an invalid capture.

Diff: diff --git a/tests/TESTLIST b/tests/TESTLIST
index fdcd593c6d..388dcfe8af 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -521,10 +521,11 @@ esis_snpa_asan-5	esis_snpa_asan-5.pcap		esis_snpa_asan-5.out	-v
 dhcp6_reconf_asan	dhcp6_reconf_asan.pcap		dhcp6_reconf_asan.out	-v
 pgm_opts_asan		pgm_opts_asan.pcap		pgm_opts_asan.out	-v
 pgm_opts_asan_2		pgm_opts_asan_2.pcap		pgm_opts_asan_2.out	-v
 pgm_opts_asan_3		pgm_opts_asan_3.pcap		pgm_opts_asan_3.out	-v
 vtp_asan		vtp_asan.pcap			vtp_asan.out	-v
+vtp_asan-2		vtp_asan-2.pcap			vtp_asan-2.out	-v
 icmp6_mobileprefix_asan	icmp6_mobileprefix_asan.pcap	icmp6_mobileprefix_asan.out	-v
 ip_printroute_asan	ip_printroute_asan.pcap		ip_printroute_asan.out	-v
 mobility_opt_asan	mobility_opt_asan.pcap		mobility_opt_asan.out	-v
 mobility_opt_asan_2	mobility_opt_asan_2.pcap	mobility_opt_asan_2.out	-v
 mobility_opt_asan_3	mobility_opt_asan_3.pcap	mobility_opt_asan_3.out	-v
diff --git a/tests/vtp_asan-2.out b/tests/vtp_asan-2.out
new file mode 100644
index 0000000000..32c319da75
--- /dev/null
+++ b/tests/vtp_asan-2.out
@@ -0,0 +1,3 @@
+FRF.16 Frag, seq 193, Flags [Begin, End], UI 08! VTPv69, Message Subset advertisement (0x02), length 2126400013
+	Domain name: , Seq number: 0, Config Rev fb499603
+	VLAN info status Unknown, type TrCRF, VLAN-id 256, MTU 771, SAID 0x03030303, Name ^C^I^C[|vtp]
diff --git a/tests/vtp_asan-2.pcap b/tests/vtp_asan-2.pcap
new file mode 100644
index 0000000000..31a9f5e1a2
Binary files /dev/null and b/tests/vtp_asan-2.pcap differ

Fixed code: vtp_asan-2		vtp_asan-2.pcap			vtp_asan-2.out	-v
FRF.16 Frag, seq 193, Flags [Begin, End], UI 08! VTPv69, Message Subset advertisement (0x02), length 2126400013
	Domain name: , Seq number: 0, Config Rev fb499603
	VLAN info status Unknown, type TrCRF, VLAN-id 256, MTU 771, SAID 0x03030303, Name ^C^I^C[|vtp]
CVE-2017-13020: Out-of-bounds Read (CWE-125)
value: The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-vtp.c, tests/TESTLIST, tests/vtp_asan.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13020/VTP: Add some missing bounds checks.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.

Diff: diff --git a/print-vtp.c b/print-vtp.c
index 285beb96ae..18c1356ef3 100644
--- a/print-vtp.c
+++ b/print-vtp.c
@@ -221,10 +221,11 @@ vtp_print (netdissect_options *ndo,
 	 *  |                         VLAN info field N                     |
 	 *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 	 *
 	 */
 
+	ND_TCHECK_32BITS(tptr);
 	ND_PRINT((ndo, ", Config Rev %x", EXTRACT_32BITS(tptr)));
 
 	/*
 	 *  VLAN INFORMATION
 	 *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
@@ -241,10 +242,11 @@ vtp_print (netdissect_options *ndo,
 	 */
 
 	tptr += 4;
 	while (tptr < (pptr+length)) {
 
+	    ND_TCHECK_8BITS(tptr);
 	    len = *tptr;
 	    if (len == 0)
 		break;
 
 	    ND_TCHECK2(*tptr, len);
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 9423723288..6f5d3314d2 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -519,10 +519,11 @@ esis_snpa_asan-3	esis_snpa_asan-3.pcap		esis_snpa_asan-3.out	-v
 esis_snpa_asan-4	esis_snpa_asan-4.pcap		esis_snpa_asan-4.out	-v
 esis_snpa_asan-5	esis_snpa_asan-5.pcap		esis_snpa_asan-5.out	-v
 dhcp6_reconf_asan	dhcp6_reconf_asan.pcap		dhcp6_reconf_asan.out	-v
 pgm_opts_asan		pgm_opts_asan.pcap		pgm_opts_asan.out	-v
 pgm_opts_asan_2		pgm_opts_asan_2.pcap		pgm_opts_asan_2.out	-v
+vtp_asan		vtp_asan.pcap			vtp_asan.out	-v
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
diff --git a/tests/vtp_asan.out b/tests/vtp_asan.out
new file mode 100644
index 0000000000..17b682bf6b
--- /dev/null
+++ b/tests/vtp_asan.out
@@ -0,0 +1,6 @@
+FRF.16 Frag, seq 193, Flags [Begin, End], UI 08! VTPv69, Message Subset advertisement (0x02), length 2126400013
+	Domain name: , Seq number: 0[|vtp]
+[|mfr]
+[|mfr]
+[|mfr]
+[|mfr]
diff --git a/tests/vtp_asan.pcap b/tests/vtp_asan.pcap
new file mode 100644
index 0000000000..515828a0b6
Binary files /dev/null and b/tests/vtp_asan.pcap differ

Fixed code: 	ND_TCHECK_32BITS(tptr);
	    ND_TCHECK_8BITS(tptr);
vtp_asan		vtp_asan.pcap			vtp_asan.out	-v
FRF.16 Frag, seq 193, Flags [Begin, End], UI 08! VTPv69, Message Subset advertisement (0x02), length 2126400013
	Domain name: , Seq number: 0[|vtp]
[|mfr]
[|mfr]
[|mfr]
[|mfr]
CVE-2017-13021: Out-of-bounds Read (CWE-125)
value: The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-icmp6.c, tests/TESTLIST, tests/icmp6_mobileprefix_asan.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13021/ICMP6: Add a missing bounds check.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.

Diff: diff --git a/print-icmp6.c b/print-icmp6.c
index 7fe639dc83..c481e446fa 100644
--- a/print-icmp6.c
+++ b/print-icmp6.c
@@ -1129,10 +1129,11 @@ icmp6_print(netdissect_options *ndo,
 		break;
 	case ICMP6_MOBILEPREFIX_ADVERT:
 		if (ndo->ndo_vflag) {
 			ND_TCHECK(dp->icmp6_data16[0]);
 			ND_PRINT((ndo,", id 0x%04x", EXTRACT_16BITS(&dp->icmp6_data16[0])));
+			ND_TCHECK(dp->icmp6_data16[1]);
 			if (dp->icmp6_data16[1] & 0xc0)
 				ND_PRINT((ndo," "));
 			if (dp->icmp6_data16[1] & 0x80)
 				ND_PRINT((ndo,"M"));
 			if (dp->icmp6_data16[1] & 0x40)
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 6f5d3314d2..070010c766 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -520,10 +520,11 @@ esis_snpa_asan-4	esis_snpa_asan-4.pcap		esis_snpa_asan-4.out	-v
 esis_snpa_asan-5	esis_snpa_asan-5.pcap		esis_snpa_asan-5.out	-v
 dhcp6_reconf_asan	dhcp6_reconf_asan.pcap		dhcp6_reconf_asan.out	-v
 pgm_opts_asan		pgm_opts_asan.pcap		pgm_opts_asan.out	-v
 pgm_opts_asan_2		pgm_opts_asan_2.pcap		pgm_opts_asan_2.out	-v
 vtp_asan		vtp_asan.pcap			vtp_asan.out	-v
+icmp6_mobileprefix_asan	icmp6_mobileprefix_asan.pcap	icmp6_mobileprefix_asan.out	-v
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
diff --git a/tests/icmp6_mobileprefix_asan.out b/tests/icmp6_mobileprefix_asan.out
new file mode 100644
index 0000000000..0e0d97c341
--- /dev/null
+++ b/tests/icmp6_mobileprefix_asan.out
@@ -0,0 +1,2 @@
+IP6 (class 0x50, flowlabel 0x0002c, hlim 0, next-header ICMPv6 (58) payload length: 7168) 4f:f829:c:1a1a:1a1a:1a1a:1a37:0 > 16:0:400:0:64fb:9303:f293:8200: ICMP6, mobile router advertisement, length 7168, id 0x9393[|icmp6]
+[|ether]
diff --git a/tests/icmp6_mobileprefix_asan.pcap b/tests/icmp6_mobileprefix_asan.pcap
new file mode 100644
index 0000000000..fa40fbb283
Binary files /dev/null and b/tests/icmp6_mobileprefix_asan.pcap differ

Fixed code: 			ND_TCHECK(dp->icmp6_data16[1]);
icmp6_mobileprefix_asan	icmp6_mobileprefix_asan.pcap	icmp6_mobileprefix_asan.out	-v
IP6 (class 0x50, flowlabel 0x0002c, hlim 0, next-header ICMPv6 (58) payload length: 7168) 4f:f829:c:1a1a:1a1a:1a1a:1a37:0 > 16:0:400:0:64fb:9303:f293:8200: ICMP6, mobile router advertisement, length 7168, id 0x9393[|icmp6]
[|ether]
CVE-2017-13024: Out-of-bounds Read (CWE-125)
value: The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-mobility.c, tests/TESTLIST, tests/mobility_opt_asan_2.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13024/IPv6 mobility: Add a bounds check before fetching data

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'

Diff: diff --git a/print-mobility.c b/print-mobility.c
index 64497b36e8..21a0fbade4 100644
--- a/print-mobility.c
+++ b/print-mobility.c
@@ -164,10 +164,12 @@ mobility_opt_print(netdissect_options *ndo,
 		case IP6MOPT_NONCEID:
 			if (len - i < IP6MOPT_NONCEID_MINLEN) {
 				ND_PRINT((ndo, "(ni: trunc)"));
 				goto trunc;
 			}
+			ND_TCHECK_16BITS(&bp[i+2]);
+			ND_TCHECK_16BITS(&bp[i+4]);
 			ND_PRINT((ndo, "(ni: ho=0x%04x co=0x%04x)",
 				EXTRACT_16BITS(&bp[i+2]),
 				EXTRACT_16BITS(&bp[i+4])));
 			break;
 		case IP6MOPT_AUTH:
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 3e215960d7..e0caaa34b5 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -523,10 +523,11 @@ pgm_opts_asan		pgm_opts_asan.pcap		pgm_opts_asan.out	-v
 pgm_opts_asan_2		pgm_opts_asan_2.pcap		pgm_opts_asan_2.out	-v
 vtp_asan		vtp_asan.pcap			vtp_asan.out	-v
 icmp6_mobileprefix_asan	icmp6_mobileprefix_asan.pcap	icmp6_mobileprefix_asan.out	-v
 ip_printroute_asan	ip_printroute_asan.pcap		ip_printroute_asan.out	-v
 mobility_opt_asan	mobility_opt_asan.pcap		mobility_opt_asan.out	-v
+mobility_opt_asan_2	mobility_opt_asan_2.pcap	mobility_opt_asan_2.out	-v
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
diff --git a/tests/mobility_opt_asan_2.out b/tests/mobility_opt_asan_2.out
new file mode 100644
index 0000000000..403926e5b2
--- /dev/null
+++ b/tests/mobility_opt_asan_2.out
@@ -0,0 +1 @@
+IP6 (class 0x50, flowlabel 0x0002c, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) ff:7f0f:40:0:ee00:0:b658:5203 > 205:20:1:b00:0:2200:af01:e000: mobility: BRR(type-0x06: len=0)[|MOBILITY]
diff --git a/tests/mobility_opt_asan_2.pcap b/tests/mobility_opt_asan_2.pcap
new file mode 100644
index 0000000000..7fadc580f5
Binary files /dev/null and b/tests/mobility_opt_asan_2.pcap differ

Fixed code: 			ND_TCHECK_16BITS(&bp[i+2]);
			ND_TCHECK_16BITS(&bp[i+4]);
mobility_opt_asan_2	mobility_opt_asan_2.pcap	mobility_opt_asan_2.out	-v
IP6 (class 0x50, flowlabel 0x0002c, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) ff:7f0f:40:0:ee00:0:b658:5203 > 205:20:1:b00:0:2200:af01:e000: mobility: BRR(type-0x06: len=0)[|MOBILITY]
CVE-2017-13024: Out-of-bounds Read (CWE-125)
value: The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: tests/TESTLIST, tests/mobility_opt_asan_4.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13024/IPv6 mobility: Add another test for a previous bounds check fix

This is another capture file supplied by Bhargava Shastry, modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'

Diff: diff --git a/tests/TESTLIST b/tests/TESTLIST
index 2f3ab1ab51..4c7ab50e2f 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -525,10 +525,11 @@ vtp_asan		vtp_asan.pcap			vtp_asan.out	-v
 icmp6_mobileprefix_asan	icmp6_mobileprefix_asan.pcap	icmp6_mobileprefix_asan.out	-v
 ip_printroute_asan	ip_printroute_asan.pcap		ip_printroute_asan.out	-v
 mobility_opt_asan	mobility_opt_asan.pcap		mobility_opt_asan.out	-v
 mobility_opt_asan_2	mobility_opt_asan_2.pcap	mobility_opt_asan_2.out	-v
 mobility_opt_asan_3	mobility_opt_asan_3.pcap	mobility_opt_asan_3.out	-v
+mobility_opt_asan_4	mobility_opt_asan_4.pcap	mobility_opt_asan_4.out	-v
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
diff --git a/tests/mobility_opt_asan_4.out b/tests/mobility_opt_asan_4.out
new file mode 100644
index 0000000000..d44f4e9d0f
--- /dev/null
+++ b/tests/mobility_opt_asan_4.out
@@ -0,0 +1 @@
+IP6 (class 0x50, flowlabel 0x00004, hlim 237, next-header Mobile IP (old) (62) payload length: 7168) d3c3:b2a9:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: BU seq#=116 A lifetime=15360(pad1)(pad1)(type-0x3c: len=19)(ni: ho=0x0400 co=0x0012)[|MOBILITY]
diff --git a/tests/mobility_opt_asan_4.pcap b/tests/mobility_opt_asan_4.pcap
new file mode 100644
index 0000000000..c03cad6569
Binary files /dev/null and b/tests/mobility_opt_asan_4.pcap differ

Fixed code: mobility_opt_asan_4	mobility_opt_asan_4.pcap	mobility_opt_asan_4.out	-v
IP6 (class 0x50, flowlabel 0x00004, hlim 237, next-header Mobile IP (old) (62) payload length: 7168) d3c3:b2a9:200:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: BU seq#=116 A lifetime=15360(pad1)(pad1)(type-0x3c: len=19)(ni: ho=0x0400 co=0x0012)[|MOBILITY]
CVE-2017-13028: Out-of-bounds Read (CWE-125)
value: The BOOTP parser in tcpdump before 4.9.2 has a buffer over-read in print-bootp.c:bootp_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: tests/TESTLIST, tests/bootp_asan-2.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13028/BOOTP: Add another test.

A capture file supplied by Bhargava Shastry, modified so the capture
file won't be rejected as an invalid capture.

Diff: diff --git a/tests/TESTLIST b/tests/TESTLIST
index 314afa2238..fdcd593c6d 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -534,10 +534,11 @@ isis_stlv_asan		isis_stlv_asan.pcap		isis_stlv_asan.out	-v
 isis_stlv_asan-2	isis_stlv_asan-2.pcap		isis_stlv_asan-2.out	-v
 isis_stlv_asan-3	isis_stlv_asan-3.pcap		isis_stlv_asan-3.out	-v
 isis_stlv_asan-4	isis_stlv_asan-4.pcap		isis_stlv_asan-4.out	-v
 lldp_mgmt_addr_tlv_asan	lldp_mgmt_addr_tlv_asan.pcap	lldp_mgmt_addr_tlv_asan.out	-v
 bootp_asan		bootp_asan.pcap			bootp_asan.out		-v
+bootp_asan-2		bootp_asan-2.pcap		bootp_asan-2.out	-v
 ppp_ccp_config_deflate_option_asan	ppp_ccp_config_deflate_option_asan.pcap	ppp_ccp_config_deflate_option_asan.out	-v
 pim_header_asan		pim_header_asan.pcap		pim_header_asan.out	-v
 pim_header_asan-2	pim_header_asan-2.pcap		pim_header_asan-2.out	-v
 pim_header_asan-3	pim_header_asan-3.pcap		pim_header_asan-3.out	-v
 ip6_frag_asan		ip6_frag_asan.pcap		ip6_frag_asan.out	-v
diff --git a/tests/bootp_asan-2.out b/tests/bootp_asan-2.out
new file mode 100644
index 0000000000..d3ae8d99a6
--- /dev/null
+++ b/tests/bootp_asan-2.out
@@ -0,0 +1,2 @@
+IP (tos 0x0, ttl 252, id 40207, offset 0, flags [+, DF, rsvd], proto UDP (17), length 60951, bad cksum ff (->8336)!)
+    18.0.0.15.16896 > 107.95.83.32.68: BOOTP/DHCP, unknown (0x00), length 59384, htype 0, hlen 0, hops 13, xid 0x14000000, secs 3328 [|bootp]
diff --git a/tests/bootp_asan-2.pcap b/tests/bootp_asan-2.pcap
new file mode 100644
index 0000000000..a79941f320
Binary files /dev/null and b/tests/bootp_asan-2.pcap differ

Fixed code: bootp_asan-2		bootp_asan-2.pcap		bootp_asan-2.out	-v
IP (tos 0x0, ttl 252, id 40207, offset 0, flags [+, DF, rsvd], proto UDP (17), length 60951, bad cksum ff (->8336)!)
    18.0.0.15.16896 > 107.95.83.32.68: BOOTP/DHCP, unknown (0x00), length 59384, htype 0, hlen 0, hops 13, xid 0x14000000, secs 3328 [|bootp]
CVE-2017-13028: Out-of-bounds Read (CWE-125)
value: The BOOTP parser in tcpdump before 4.9.2 has a buffer over-read in print-bootp.c:bootp_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-bootp.c, tests/TESTLIST, tests/bootp_asan.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13028/BOOTP: Add a bounds check before fetching data

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'

Diff: diff --git a/print-bootp.c b/print-bootp.c
index ce2ecac4f4..51e53844c1 100644
--- a/print-bootp.c
+++ b/print-bootp.c
@@ -320,10 +320,11 @@ bootp_print(netdissect_options *ndo,
 	if (EXTRACT_32BITS(&bp->bp_xid))
 		ND_PRINT((ndo, ", xid 0x%x", EXTRACT_32BITS(&bp->bp_xid)));
 	if (EXTRACT_16BITS(&bp->bp_secs))
 		ND_PRINT((ndo, ", secs %d", EXTRACT_16BITS(&bp->bp_secs)));
 
+	ND_TCHECK(bp->bp_flags);
 	ND_PRINT((ndo, ", Flags [%s]",
 		  bittok2str(bootp_flag_values, "none", EXTRACT_16BITS(&bp->bp_flags))));
 	if (ndo->ndo_vflag > 1)
 		ND_PRINT((ndo, " (0x%04x)", EXTRACT_16BITS(&bp->bp_flags)));
 
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 9ac274704c..8b90e1f5d5 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -531,10 +531,11 @@ mobility_opt_asan_4	mobility_opt_asan_4.pcap	mobility_opt_asan_4.out	-v
 isis_stlv_asan		isis_stlv_asan.pcap		isis_stlv_asan.out	-v
 isis_stlv_asan-2	isis_stlv_asan-2.pcap		isis_stlv_asan-2.out	-v
 isis_stlv_asan-3	isis_stlv_asan-3.pcap		isis_stlv_asan-3.out	-v
 isis_stlv_asan-4	isis_stlv_asan-4.pcap		isis_stlv_asan-4.out	-v
 lldp_mgmt_addr_tlv_asan	lldp_mgmt_addr_tlv_asan.pcap	lldp_mgmt_addr_tlv_asan.out	-v
+bootp_asan		bootp_asan.pcap			bootp_asan.out		-v
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
diff --git a/tests/bootp_asan.out b/tests/bootp_asan.out
new file mode 100644
index 0000000000..d3ae8d99a6
--- /dev/null
+++ b/tests/bootp_asan.out
@@ -0,0 +1,2 @@
+IP (tos 0x0, ttl 252, id 40207, offset 0, flags [+, DF, rsvd], proto UDP (17), length 60951, bad cksum ff (->8336)!)
+    18.0.0.15.16896 > 107.95.83.32.68: BOOTP/DHCP, unknown (0x00), length 59384, htype 0, hlen 0, hops 13, xid 0x14000000, secs 3328 [|bootp]
diff --git a/tests/bootp_asan.pcap b/tests/bootp_asan.pcap
new file mode 100644
index 0000000000..7c8a6ae120
Binary files /dev/null and b/tests/bootp_asan.pcap differ

Fixed code: 	ND_TCHECK(bp->bp_flags);
bootp_asan		bootp_asan.pcap			bootp_asan.out		-v
IP (tos 0x0, ttl 252, id 40207, offset 0, flags [+, DF, rsvd], proto UDP (17), length 60951, bad cksum ff (->8336)!)
    18.0.0.15.16896 > 107.95.83.32.68: BOOTP/DHCP, unknown (0x00), length 59384, htype 0, hlen 0, hops 13, xid 0x14000000, secs 3328 [|bootp]
CVE-2017-13036: Out-of-bounds Read (CWE-125)
value: The OSPFv3 parser in tcpdump before 4.9.2 has a buffer over-read in print-ospf6.c:ospf6_decode_v3().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-ospf6.c, tests/TESTLIST, tests/ospf6_decode_v3_asan.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13036/OSPFv3: Add a bounds check before fetching data

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.

Diff: diff --git a/print-ospf6.c b/print-ospf6.c
index e8a9dc6d54..381fdbbf71 100644
--- a/print-ospf6.c
+++ b/print-ospf6.c
@@ -733,10 +733,11 @@ ospf6_decode_v3(netdissect_options *ndo,
 	switch (op->ospf6_type) {
 
 	case OSPF_TYPE_HELLO: {
 		register const struct hello6 *hellop = (const struct hello6 *)((const uint8_t *)op + OSPF6HDR_LEN);
 
+		ND_TCHECK_32BITS(&hellop->hello_options);
 		ND_PRINT((ndo, "\n\tOptions [%s]",
 		          bittok2str(ospf6_option_values, "none",
 		          EXTRACT_32BITS(&hellop->hello_options))));
 
 		ND_TCHECK(hellop->hello_deadint);
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 3adc5c7f37..20d655c886 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -547,10 +547,11 @@ ppp_ccp_config_deflate_option_asan	ppp_ccp_config_deflate_option_asan.pcap	ppp_c
 pim_header_asan		pim_header_asan.pcap		pim_header_asan.out	-v
 pim_header_asan-2	pim_header_asan-2.pcap		pim_header_asan-2.out	-v
 pim_header_asan-3	pim_header_asan-3.pcap		pim_header_asan-3.out	-v
 ip6_frag_asan		ip6_frag_asan.pcap		ip6_frag_asan.out	-v
 radius_attr_asan	radius_attr_asan.pcap		radius_attr_asan.out	-v
+ospf6_decode_v3_asan	ospf6_decode_v3_asan.pcap	ospf6_decode_v3_asan.out -v
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
diff --git a/tests/ospf6_decode_v3_asan.out b/tests/ospf6_decode_v3_asan.out
new file mode 100644
index 0000000000..aef79e0a7b
--- /dev/null
+++ b/tests/ospf6_decode_v3_asan.out
@@ -0,0 +1,2 @@
+IP6 (class 0x76, flowlabel 0xf6701, hlim 109, next-header OSPF (89) payload length: 30311) 6767:6780:6767:a102:4:b6:5853:f040 > 1000:a32:8847:1::116: OSPFv3, Hello, length 30311
+	Router-ID 1.1.0.34, Area 0.255.2.2, Instance 82 [|ospf3]
diff --git a/tests/ospf6_decode_v3_asan.pcap b/tests/ospf6_decode_v3_asan.pcap
new file mode 100644
index 0000000000..2d50b9c1f4
Binary files /dev/null and b/tests/ospf6_decode_v3_asan.pcap differ

Fixed code: 		ND_TCHECK_32BITS(&hellop->hello_options);
ospf6_decode_v3_asan	ospf6_decode_v3_asan.pcap	ospf6_decode_v3_asan.out -v
IP6 (class 0x76, flowlabel 0xf6701, hlim 109, next-header OSPF (89) payload length: 30311) 6767:6780:6767:a102:4:b6:5853:f040 > 1000:a32:8847:1::116: OSPFv3, Hello, length 30311
	Router-ID 1.1.0.34, Area 0.255.2.2, Instance 82 [|ospf3]
CVE-2017-13038: Out-of-bounds Read (CWE-125)
value: The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-ppp.c, tests/TESTLIST, tests/mlppp-oobr.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13038/PPP: Do bounds checking.

This fixes a buffer over-read discovered by Brian 'geeknik' Carpenter.

Add a test using the capture file supplied by Katie Holly.

Diff: diff --git a/print-ppp.c b/print-ppp.c
index d07763cb1c..891761728b 100644
--- a/print-ppp.c
+++ b/print-ppp.c
@@ -809,10 +809,19 @@ handle_mlppp(netdissect_options *ndo,
              const u_char *p, int length)
 {
     if (!ndo->ndo_eflag)
         ND_PRINT((ndo, "MLPPP, "));
 
+    if (length < 2) {
+        ND_PRINT((ndo, "[|mlppp]"));
+        return;
+    }
+    if (!ND_TTEST_16BITS(p)) {
+        ND_PRINT((ndo, "[|mlppp]"));
+        return;
+    }
+
     ND_PRINT((ndo, "seq 0x%03x, Flags [%s], length %u",
            (EXTRACT_16BITS(p))&0x0fff, /* only support 12-Bit sequence space for now */
            bittok2str(ppp_ml_flag_values, "none", *p & 0xc0),
            length));
 }
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 5732f8ff50..bdc7ff40c6 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -552,10 +552,13 @@ pim_header_asan-4	pim_header_asan-4.pcap		pim_header_asan-4.out	-v
 ip6_frag_asan		ip6_frag_asan.pcap		ip6_frag_asan.out	-v
 radius_attr_asan	radius_attr_asan.pcap		radius_attr_asan.out	-v
 ospf6_decode_v3_asan	ospf6_decode_v3_asan.pcap	ospf6_decode_v3_asan.out -v
 ip_ts_opts_asan		ip_ts_opts_asan.pcap		ip_ts_opts_asan.out	-v
 
+# bad packets from Katie Holly
+mlppp-oobr		mlppp-oobr.pcap			mlppp-oobr.out
+
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
 
diff --git a/tests/mlppp-oobr.out b/tests/mlppp-oobr.out
new file mode 100644
index 0000000000..9230189c76
--- /dev/null
+++ b/tests/mlppp-oobr.out
@@ -0,0 +1 @@
+MLPPP, [|mlppp]
diff --git a/tests/mlppp-oobr.pcap b/tests/mlppp-oobr.pcap
new file mode 100644
index 0000000000..95b1bbe364
Binary files /dev/null and b/tests/mlppp-oobr.pcap differ

Fixed code:     if (length < 2) {
        ND_PRINT((ndo, "[|mlppp]"));
        return;
    }
    if (!ND_TTEST_16BITS(p)) {
        ND_PRINT((ndo, "[|mlppp]"));
        return;
    }

# bad packets from Katie Holly
mlppp-oobr		mlppp-oobr.pcap			mlppp-oobr.out

MLPPP, [|mlppp]
CVE-2017-13041: Out-of-bounds Read (CWE-125)
value: The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-icmp6.c, tests/TESTLIST, tests/icmp6_nodeinfo_oobr.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13041/ICMP6: Add more bounds checks.

This fixes a buffer over-read discovered by Kim Gwan Yeong.

Add a test using the capture file supplied by the reporter(s).

Diff: diff --git a/print-icmp6.c b/print-icmp6.c
index c481e446fa..42fe19f298 100644
--- a/print-icmp6.c
+++ b/print-icmp6.c
@@ -1697,10 +1697,11 @@ icmp6_nodeinfo_print(netdissect_options *ndo, u_int icmp6len, const u_char *bp,
 			break;
 		}
 
 		needcomma = 0;
 
+		ND_TCHECK2(*dp, sizeof(*ni6));
 		ni6 = (const struct icmp6_nodeinfo *)dp;
 		ND_PRINT((ndo," node information reply"));
 		ND_PRINT((ndo," ("));	/*)*/
 		switch (ni6->ni_code) {
 		case ICMP6_NI_SUCCESS:
@@ -1751,10 +1752,11 @@ icmp6_nodeinfo_print(netdissect_options *ndo, u_int icmp6len, const u_char *bp,
 		case NI_QTYPE_FQDN:
 			if (needcomma)
 				ND_PRINT((ndo,", "));
 			ND_PRINT((ndo,"DNS name"));
 			cp = (const u_char *)(ni6 + 1) + 4;
+			ND_TCHECK(cp[0]);
 			if (cp[0] == ep - cp - 1) {
 				/* icmp-name-lookup-03, pascal string */
 				if (ndo->ndo_vflag)
 					ND_PRINT((ndo,", 03 draft"));
 				cp++;
diff --git a/tests/TESTLIST b/tests/TESTLIST
index c3f397338d..a8811bc696 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -558,10 +558,11 @@ isakmpv1-attr-oobr	isakmpv1-attr-oobr.pcap		isakmpv1-attr-oobr.out	-v
 # bad packets from Katie Holly
 mlppp-oobr		mlppp-oobr.pcap			mlppp-oobr.out
 
 # bad packets from Kim Gwan Yeong
 mptcp-dss-oobr		mptcp-dss-oobr.pcap		mptcp-dss-oobr.out	-v
+icmp6_nodeinfo_oobr	icmp6_nodeinfo_oobr.pcap	icmp6_nodeinfo_oobr.out
 
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp
 rtp-seg-fault-2  rtp-seg-fault-2.pcap  rtp-seg-fault-2.out  -v -T rtp
diff --git a/tests/icmp6_nodeinfo_oobr.out b/tests/icmp6_nodeinfo_oobr.out
new file mode 100644
index 0000000000..0856ea2f01
--- /dev/null
+++ b/tests/icmp6_nodeinfo_oobr.out
@@ -0,0 +1 @@
+IP6 a072:7f00:1:7f00:1:e01a:17:6785 > c903::a002:8018:fe30:0:204: ICMP6, who-are-you reply[|icmp6], length 4
diff --git a/tests/icmp6_nodeinfo_oobr.pcap b/tests/icmp6_nodeinfo_oobr.pcap
new file mode 100644
index 0000000000..4c3ff04dea
Binary files /dev/null and b/tests/icmp6_nodeinfo_oobr.pcap differ

Fixed code: 		ND_TCHECK2(*dp, sizeof(*ni6));
			ND_TCHECK(cp[0]);
icmp6_nodeinfo_oobr	icmp6_nodeinfo_oobr.pcap	icmp6_nodeinfo_oobr.out
IP6 a072:7f00:1:7f00:1:e01a:17:6785 > c903::a002:8018:fe30:0:204: ICMP6, who-are-you reply[|icmp6], length 4