Code:  l2tp_q931_cc_print(netdissect_options *ndo, const u_char *dat, u_int length)
 {
 	print_16bits_val(ndo, (const uint16_t *)dat);
 	ND_PRINT((ndo, ", %02x", dat[2]));
	if (length > 3) {
 		ND_PRINT((ndo, " "));
		print_string(ndo, dat+3, length-3);
 	}
 }

Vulnerability Type: 
CWE ID: CWE-125
Summary: The L2TP parser in tcpdump before 4.9.2 has a buffer over-read in print-l2tp.c, several functions.
Commit Message: CVE-2017-13006/L2TP: Check whether an AVP's content exceeds the AVP length.

It's not good enough to check whether all the data specified by the AVP
length was captured - you also have to check whether that length is
large enough for all the required data in the AVP.

This fixes a buffer over-read discovered by Yannick Formaggio.

Add a test using the capture file supplied by the reporter(s).