From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Fri, 5 May 2017 01:33:31 +0000 (-0400)
Subject: Merge pull request #881 in SNORT/snort3 from cd_cmd to master
X-Git-Tag: 3.0.0-233~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=05458b3e199979eca9f3d2c327a9b0cecae7be2d;p=thirdparty%2Fsnort3.git

Merge pull request #881 in SNORT/snort3 from cd_cmd to master

Squashed commit of the following:

commit e8ec31370c4c9ca5160d0e739753e7c9666b8b8e
Author: Russ Combs <rucombs@cisco.com>
Date:   Thu May 4 18:12:11 2017 -0400

    fix extraction of ether type from cisco metadata
---

diff --git a/src/codecs/link/cd_ciscometadata.cc b/src/codecs/link/cd_ciscometadata.cc
index 1d7794202..4574a1efc 100644
--- a/src/codecs/link/cd_ciscometadata.cc
+++ b/src/codecs/link/cd_ciscometadata.cc
@@ -133,9 +133,11 @@ bool CiscoMetaDataCodec::decode(const RawData& raw, CodecData& codec, DecodeData
     }
 
     codec.lyr_len = cmdh->length << 3;
+
     //The last 2 octets of the header will be the real ethtype
-    codec.next_prot_id =
-        static_cast<ProtocolId>(ntohs(*(raw.data + codec.lyr_len - sizeof(uint16_t))));
+    codec.next_prot_id = static_cast<ProtocolId>
+        (ntohs(*((uint16_t*)(raw.data + codec.lyr_len - sizeof(uint16_t)))));
+
     codec.codec_flags |= CODEC_ETHER_NEXT;
     return true;
 }