Code: le64addr_string(netdissect_options *ndo, const u_char *ep)
{
 	const unsigned int len = 8;
 	register u_int i;
 	register char *cp;
	register struct enamemem *tp;
 	char buf[BUFSIZE];
 
 	tp = lookup_bytestring(ndo, ep, len);
	if (tp->e_name)
		return (tp->e_name);
 
 	cp = buf;
 	for (i = len; i > 0 ; --i) {
		*cp++ = hex[*(ep + i - 1) >> 4];
		*cp++ = hex[*(ep + i - 1) & 0xf];
		*cp++ = ':';
	}
	cp --;
 
 	*cp = '\0';
 
	tp->e_name = strdup(buf);
	if (tp->e_name == NULL)
 		(*ndo->ndo_error)(ndo, "le64addr_string: strdup(buf)");
 
	return (tp->e_name);
 }

Commit Message: CVE-2017-12894/In lookup_bytestring(), take the length of the byte string into account.

Otherwise, if, in our search of the hash table, we come across a byte
string that's shorter than the string we're looking for, we'll search
past the end of the string in the hash table.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add a test using the capture file supplied by the reporter(s).
CWE ID: CWE-125
le64addr_string(netdissect_options *ndo, const u_char *ep)
{
 	const unsigned int len = 8;
 	register u_int i;
 	register char *cp;
	register struct bsnamemem *tp;
 	char buf[BUFSIZE];
 
 	tp = lookup_bytestring(ndo, ep, len);
	if (tp->bs_name)
		return (tp->bs_name);
 
 	cp = buf;
 	for (i = len; i > 0 ; --i) {
		*cp++ = hex[*(ep + i - 1) >> 4];
		*cp++ = hex[*(ep + i - 1) & 0xf];
		*cp++ = ':';
	}
	cp --;
 
 	*cp = '\0';
 
	tp->bs_name = strdup(buf);
	if (tp->bs_name == NULL)
 		(*ndo->ndo_error)(ndo, "le64addr_string: strdup(buf)");
 
	return (tp->bs_name);
 }
