Merge pull request #881 in SNORT/snort3 from cd_cmd to master

Squashed commit of the following:

commit e8ec31370c4c9ca5160d0e739753e7c9666b8b8e
Author: Russ Combs <rucombs@cisco.com>
Date:   Thu May 4 18:12:11 2017 -0400

    fix extraction of ether type from cisco metadata

diff --git a/src/codecs/link/cd_ciscometadata.cc b/src/codecs/link/cd_ciscometadata.cc
index 1d7794202805ad55ddcafbfe2d35a997612b3404..4574a1efc4826355b764407d2368ec497c68b5cd 100644 (file)
--- a/src/codecs/link/cd_ciscometadata.cc
+++ b/src/codecs/link/cd_ciscometadata.cc
@@ -133,9 +133,11 @@ bool CiscoMetaDataCodec::decode(const RawData& raw, CodecData& codec, DecodeData
     }
 
     codec.lyr_len = cmdh->length << 3;
+
     //The last 2 octets of the header will be the real ethtype
-    codec.next_prot_id =
-        static_cast<ProtocolId>(ntohs(*(raw.data + codec.lyr_len - sizeof(uint16_t))));
+    codec.next_prot_id = static_cast<ProtocolId>
+        (ntohs(*((uint16_t*)(raw.data + codec.lyr_len - sizeof(uint16_t)))));
+
     codec.codec_flags |= CODEC_ETHER_NEXT;
     return true;
 }