Ettercap/ettercap — pull request #97 by jacob-baines (2013-03-02 15:31:21+00:00)
Title: Various Invalid Reads in SNMP

The SNMP dissector increments the data pointer based on packet data without bounds checking causing various invalid reads (and perhaps more) on malformed packets.

Example valgrind warning:

==31053== Invalid read of size 1
==31053== at 0x8081DB6: dissector_snmp (ec_snmp.c:87)
==31053== by 0x80599F9: decode_data (ec_decode.c:298)
==31053== by 0x808B1C8: decode_udp (ec_udp.c:129)
==31053== by 0x808894C: decode_ip (ec_ip.c:224)
==31053== by 0x8087D5E: decode_eth (ec_eth.c:81)
==31053== by 0x805970F: ec_decode (ec_decode.c:186)

This issue can be reproduced with https://www.wireshark.org/download/automated/captures/fuzz-2006-07-05-1209.pcap