Code: int _our_safe_pcap_next_ex(pcap_t *pcap, struct pcap_pkthdr **pkthdr,
        const u_char **pktdata, const char *funcname,
        const int line, const char *file)
{
    int res = pcap_next_ex(pcap, pkthdr, pktdata);

    if (*pktdata && *pkthdr) {
        if ((*pkthdr)->len > MAXPACKET) {
            fprintf(stderr, "safe_pcap_next_ex ERROR: Invalid packet length in %s:%s() line %d: %u is greater than maximum %u\n",
                    file, funcname, line, (*pkthdr)->len, MAXPACKET);
             exit(-1);
         }
 
        if ((*pkthdr)->len < (*pkthdr)->caplen) {
            fprintf(stderr, "safe_pcap_next_ex ERROR: Invalid packet length in %s:%s() line %d: packet length %u is less than capture length %u\n",
                     file, funcname, line, (*pkthdr)->len, (*pkthdr)->caplen);
             exit(-1);
         }
    }

    return res;
}

Vulnerability Type: 
CWE ID: CWE-125
Summary: Tcpreplay before 4.3.1 has a heap-based buffer over-read in get_l2len in common/get.c.
Commit Message: Bug #520 Fix heap overflow on zero or 0xFFFF packet length

Add check for packets that report zero packet length. Example
of fix:

    src/tcpprep --auto=bridge --pcap=poc16-get_l2len-heapoverflow --cachefile=/dev/null
    Warning: poc16-get_l2len-heapoverflow was captured using a snaplen of 17 bytes.  This may mean you have truncated packets.
    safe_pcap_next ERROR: Invalid packet length in tcpprep.c:process_raw_packets() line 334: packet length=0 capture length=0