CVE-2017-13687: Out-of-bounds Read (CWE-125)
value: The Cisco HDLC parser in tcpdump before 4.9.2 has a buffer over-read in print-chdlc.c:chdlc_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: tests/TESTLIST, tests/hoobr_chdlc_print.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13687/CHDLC: Add a test.

This is for the fix made a few commits before, which had no tests.

Add a test using the capture file supplied by Kamil Frankowicz.

Diff: diff --git a/tests/TESTLIST b/tests/TESTLIST
index 7b841e9911..ec627cb828 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -453,10 +453,11 @@ oobr_parse_elements	oobr_parse_elements.pcap	oobr_parse_elements.out
 hoobr_ripng_print	hoobr_ripng_print.pcap		hoobr_ripng_print.out
 hoobr_juniper		hoobr_juniper.pcap		hoobr_juniper.out
 hoobr_juniper2		hoobr_juniper2.pcap		hoobr_juniper2.out
 hoobr_juniper3		hoobr_juniper3.pcap		hoobr_juniper3.out
 hoobr_parse_field	hoobr_parse_field.pcap		hoobr_parse_field.out
+hoobr_chdlc_print	hoobr_chdlc_print.pcap		hoobr_chdlc_print.out
 
 # bad packets from Wilfried Kirsch
 slip-bad-direction	slip-bad-direction.pcap		slip-bad-direction.out	-ve
 
 # bad packets from Otto Airamo and Antti Levomäki
diff --git a/tests/hoobr_chdlc_print.out b/tests/hoobr_chdlc_print.out
new file mode 100644
index 0000000000..5701077dba
--- /dev/null
+++ b/tests/hoobr_chdlc_print.out
@@ -0,0 +1,26 @@
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+unknown CHDLC protocol (0x3030)
+[|chdlc]
diff --git a/tests/hoobr_chdlc_print.pcap b/tests/hoobr_chdlc_print.pcap
new file mode 100644
index 0000000000..ffc75a4b21
Binary files /dev/null and b/tests/hoobr_chdlc_print.pcap differ

Fixed code: hoobr_chdlc_print	hoobr_chdlc_print.pcap		hoobr_chdlc_print.out
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
unknown CHDLC protocol (0x3030)
[|chdlc]