# CVE-2017-13019: The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print()

PGM parser in tcpdump's print-pgm.c reads 4 bytes past a heap buffer when printing crafted PGM option data, causing a heap over-read crash.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: bags
- Disclosed: 2021-08-22
- CVE: CVE-2017-13019
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/802896
- Library page: https://bugbountylibrary.com/r/h1%3A802896
- Tags: area:devices domain:network impact:dos kind:bounty platform:hackerone sev:high tech:linux technique:fuzzing vuln:dos vuln:memory-corruption

**Target:** tcpdump PGM packet printer (print-pgm.c:pgm_print)
**Root cause:** pgm_print() calls EXTRACT_32BITS on PGM option data without verifying the remaining captured length, so a truncated option field causes a 4-byte read past the allocated packet buffer.
**Steps:**
1. Clone tcpdump at commit 26a6799b9ca80508c05cac7a9a3bef922991520b (pre-4.9.2)
2. Build with `CC=afl-gcc AFL_USE_ASAN=1 make -j`
3. Run `tcpdump -nvr pgm_opts_asan_2.pcap` against the crafted PGM pcap
4. ASan reports heap-buffer-overflow READ of size 4 in EXTRACT_32BITS called from pgm_print print-pgm.c:697
**How found:** Fuzzing tcpdump with afl-gcc plus AddressSanitizer against packet captures; the crafted PGM pcap triggered an out-of-bounds read in the option-printing path.
**Insight:** Protocol printers that call EXTRACT_*BITS on option/TLV fields must bound-check against the captured length (ndo_snapend), not just the on-wire length; fuzz each dissector's option-parsing branch with truncated captures.