Ettercap/ettercap — pull request #100 by jacob-baines (2013-03-03 12:20:10+00:00)
Title: Invalid Read In DHCP

I came across this warning via valgrind:

==6515== Invalid read of size 1
==6515== at 0x807567E: get_dhcp_option (ec_dhcp.c:273)
==6515== by 0x8075312: dissector_dhcp (ec_dhcp.c:208)
==6515== by 0x80599F9: decode_data (ec_decode.c:298)
==6515== by 0x808B288: decode_udp (ec_udp.c:129)
==6515== by 0x8088A0C: decode_ip (ec_ip.c:224)
==6515== by 0x8087E1E: decode_eth (ec_eth.c:81)
==6515== by 0x805970F: ec_decode (ec_decode.c:186)

Pretty simply, the data pointer gets moved and dereferenced without bounds checking. I just swapped the && clauses to ensure the loop terminates before the dereference occurs.

This can be reproduced using https://www.wireshark.org/download/automated/captures/fuzz-2006-07-09-348.pcap