Ettercap/ettercap — pull request #112 by jacob-baines (2013-03-10 23:43:46+00:00)
Title: Added some length checks to BGP in order to avoid invalid reads.

Nothing too exciting here. BGP does various pointer manipulations without any type of length checks. I added a couple that should cover everything.

This can be recreated with https://www.wireshark.org/download/automated/captures/fuzz-2011-10-25-30900.pcap

==2821== Invalid read of size 1
==2821== at 0x807495B: dissector_bgp (in /usr/local/bin/ettercap)
==2821== by 0x8059925: decode_data (in /usr/local/bin/ettercap)
==2821== by 0x808AB58: decode_tcp (in /usr/local/bin/ettercap)
==2821== by 0x8088FE4: decode_ip (in /usr/local/bin/ettercap)
==2821== by 0x80883F6: decode_eth (in /usr/local/bin/ettercap)
==2821== by 0x805963B: ec_decode (in /usr/local/bin/ettercap)
==2821== by 0x48BE5CA: ??? (in /usr/lib/i386-linux-gnu/libpcap.so.1.3.0)
==2821== by 0x48AF3DE: pcap_loop (in /usr/lib/i386-linux-gnu/libpcap.so.1.3.0)
==2821== by 0x8056915: capture (in /usr/local/bin/ettercap)