Code:  l2tp_q931_cc_print(netdissect_options *ndo, const u_char *dat, u_int length)
 {
 	print_16bits_val(ndo, (const uint16_t *)dat);
 	ND_PRINT((ndo, ", %02x", dat[2]));
	if (length > 3) {
 		ND_PRINT((ndo, " "));
		print_string(ndo, dat+3, length-3);
 	}
 }

Commit Message: CVE-2017-13006/L2TP: Check whether an AVP's content exceeds the AVP length.

It's not good enough to check whether all the data specified by the AVP
length was captured - you also have to check whether that length is
large enough for all the required data in the AVP.

This fixes a buffer over-read discovered by Yannick Formaggio.

Add a test using the capture file supplied by the reporter(s).
CWE ID: CWE-125
 l2tp_q931_cc_print(netdissect_options *ndo, const u_char *dat, u_int length)
 {
	if (length < 3) {
		ND_PRINT((ndo, "AVP too short"));
		return;
	}
 	print_16bits_val(ndo, (const uint16_t *)dat);
 	ND_PRINT((ndo, ", %02x", dat[2]));
	dat += 3;
	length -= 3;
	if (length != 0) {
 		ND_PRINT((ndo, " "));
		print_string(ndo, dat, length);
 	}
 }
