From: Alexander Gozman <a.gozman@securitycode.ru>
Date: Mon, 20 Feb 2017 13:47:31 +0000 (+0300)
Subject: af-packet: fix parsing packet in TPACKET_V3 mode
X-Git-Tag: suricata-4.0.0-beta1~284
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=310b27a196a93b46ea719a51323fd3d4a83bea64;p=thirdparty%2Fsuricata.git

af-packet: fix parsing packet in TPACKET_V3 mode

AFPParsePacketV3() saved tpacket_block_desc structure
instead of tpacket3_hdr. As a result, reconstructed
packets were wrong.

Bug #2044.
---

diff --git a/src/source-af-packet.c b/src/source-af-packet.c
index 7e981ba242..1e25d316bb 100644
--- a/src/source-af-packet.c
+++ b/src/source-af-packet.c
@@ -992,7 +992,7 @@ static inline int AFPParsePacketV3(AFPThreadVars *ptv, struct tpacket_block_desc
             TmqhOutputPacketpool(ptv->tv, p);
             SCReturnInt(AFP_FAILURE);
         }
-        p->afp_v.relptr = pbd;
+        p->afp_v.relptr = ppd;
         p->ReleasePacket = AFPReleasePacketV3;
         p->afp_v.mpeer = ptv->mpeer;
         AFPRefSocket(ptv->mpeer);