Code: ikev1_attr_print(netdissect_options *ndo, const u_char *p, const u_char *ep)
 {
 	int totlen;
 	uint32_t t;
 
 	if (p[0] & 0x80)
 		totlen = 4;
	else
 		totlen = 4 + EXTRACT_16BITS(&p[2]);
	if (ep < p + totlen) {
 		ND_PRINT((ndo,"[|attr]"));
		return ep + 1;
 	}
 
 	ND_PRINT((ndo,"("));
 	t = EXTRACT_16BITS(&p[0]) & 0x7fff;
 	ND_PRINT((ndo,"type=#%d ", t));
 	if (p[0] & 0x80) {
 		ND_PRINT((ndo,"value="));
 		t = p[2];
		rawprint(ndo, (const uint8_t *)&p[2], 2);
 	} else {
		ND_PRINT((ndo,"len=%d value=", EXTRACT_16BITS(&p[2])));
		rawprint(ndo, (const uint8_t *)&p[4], EXTRACT_16BITS(&p[2]));
 	}
 	ND_PRINT((ndo,")"));
 	return p + totlen;
 }

Vulnerability Type: 
CWE ID: CWE-125
Summary: The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c, several functions.
Commit Message: CVE-2017-13039/IKEv1: Do more bounds checking.

Have ikev1_attrmap_print() and ikev1_attr_print() do full bounds
checking, and return null on a bounds overflow.  Have their callers
check for a null return.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.