From b3316bb5fdd44a5e455e5a3d386c291c966fc630 Mon Sep 17 00:00:00 2001
From: William Robinet <william.robinet@conostix.com>
Date: Thu, 21 Jan 2021 09:57:27 +0100
Subject: [PATCH] Fix for crash if length of captured frame is less than
 Ethernet header size

---
 base/pcap-snoop.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/base/pcap-snoop.c b/base/pcap-snoop.c
index bfa6161..5901e8b 100644
--- a/base/pcap-snoop.c
+++ b/base/pcap-snoop.c
@@ -176,6 +176,12 @@ void pcap_cb(ptr,hdr,data)
         len-=4;
         break;
       case DLT_EN10MB:
+        if(len < sizeof(struct ether_header)) {
+          if(!(NET_print_flags & NET_PRINT_JSON))
+            printf("Frame size too small to contain Ethernet header, skipping ...\n");
+          return;
+        }
+
         type=ntohs(e_hdr->ether_type);
 
         data+=sizeof(struct ether_header);