Overlapping error was found by valgrind: ==24305== Command: ./airdecap-ng -e linksys -p dictionary ../test/wpa-psk-linksys.cap ==24305== ==24305== Source and destination overlap in memcpy(0x60b938, 0x60b940, 139) ==24305== at 0x4C2DCD3: memcpy@@GLIBC_2.14 (mc_replace_strmem.c:882) ==24305== by 0x403265: main (airdecap-ng.c:877) ==24305== ==24305== Source and destination overlap in memcpy(0x60b92c, 0x60b93e, 133) ==24305== at 0x4C2DCD3: memcpy@@GLIBC_2.14 (mc_replace_strmem.c:882) ==24305== by 0x4017CD: write_packet (airdecap-ng.c:165) ==24305== by 0x4032A9: main (airdecap-ng.c:883) ==24305== And was exhibited as corrupted packets in bug: Gentoo-bug: https://bugs.gentoo.org/486984 diff --git a/src/airdecap-ng.c b/src/airdecap-ng.c index 9a7090b..a71a6be 100644 --- a/src/airdecap-ng.c +++ b/src/airdecap-ng.c @@ -162,7 +162,8 @@ int write_packet( FILE *f_out, struct pcap_pkthdr *pkh, uchar *h80211 ) pkh->len -= 24 + qosh_offset + 6; pkh->caplen -= 24 + qosh_offset + 6; - memcpy( buffer + 12, h80211 + qosh_offset + 30, pkh->caplen ); + /* can overlap */ + memmove( buffer + 12, h80211 + qosh_offset + 30, pkh->caplen ); } else { @@ -874,7 +875,8 @@ usage: /* WPA data packet was successfully decrypted, * * remove the WPA Ext.IV & MIC, write the data */ - memcpy( h80211 + z, h80211 + z + 8, pkh.caplen - z ); + /* can overlap */ + memmove( h80211 + z, h80211 + z + 8, pkh.caplen - z ); stats.nb_unwpa++;