# The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print()

Heap buffer over-read in tcpdump's VTP printer (print-vtp.c) when parsing a crafted pcap, leaking adjacent heap memory via fn_printzp.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: bags
- Disclosed: 2021-08-22
- CVE: CVE-2017-13033
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/802846
- Library page: https://bugbountylibrary.com/r/h1%3A802846
- Tags: area:devices domain:network impact:data-leak kind:bounty platform:hackerone sev:high tech:linux technique:fuzzing vuln:info-disclosure vuln:memory-corruption

**Target:** tcpdump VTP packet parser (print-vtp.c vtp_print)
**Root cause:** vtp_print() calls fn_printzp with a length derived from packet data without validating it against the remaining captured buffer, so it reads past the end of the heap-allocated packet buffer.
**Steps:**
1. Clone tcpdump at commit e0d8ee571438c755ff988f70886f8c4f5e9a8434 (< 4.9.2)
2. Build with `CC=afl-gcc AFL_USE_ASAN=1 make -j`
3. Run `tcpdump -nvr vtp_asan-3.pcap` against the linked crafted pcap
4. ASan reports heap-buffer-overflow READ of size 1 in fn_printzp called from vtp_print print-vtp.c:262
**How found:** Fuzzing tcpdump with AFL plus AddressSanitizer surfaced the over-read in the VTP print path.
**Exploitation:** Attacker supplies a crafted pcap file; when tcpdump parses the VTP payload it reads one byte past the 284-byte heap buffer, potentially disclosing adjacent heap memory in printed output.
**Insight:** Protocol printers that pass packet-derived lengths into string-print helpers (fn_printzp) are prime over-read candidates; fuzz pcap inputs with ASan and watch print-*.c call sites where length fields aren't bounded by caplen.