[Bug] heap-buffer-overflow in tcpreplay with fast_edit_packet()

[zzuf666]

Describe the bug
heap-buffer-overflow in tcpreplay with fast_edit_packet()

ASAN report

=================================================================
==126819==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6160000002ce at pc 0x0000004ca8fc bp 0x7fffab94b540 sp 0x7fffab94b538
READ of size 2 at 0x6160000002ce thread T0
    #0 0x4ca8fb in fast_edit_packet /programs/tcpreplay/tcpreplay-4.3.3/src/send_packets.c:276:18
    #1 0x4c8fa7 in send_packets /programs/tcpreplay/tcpreplay-4.3.3/src/send_packets.c:562:13
    #2 0x4d619c in replay_file /programs/tcpreplay/tcpreplay-4.3.3/src/replay.c:182:5
    #3 0x4d619c in tcpr_replay_index /programs/tcpreplay/tcpreplay-4.3.3/src/replay.c:59:29
    #4 0x4d3ff7 in tcpreplay_replay /programs/tcpreplay/tcpreplay-4.3.3/src/tcpreplay_api.c:1136:26
    #5 0x4ce979 in main /programs/tcpreplay/tcpreplay-4.3.3/src/tcpreplay.c:139:13
    #6 0x7fd5f344b0b2 in __libc_start_main /build/glibc-YYA7BZ/glibc-2.31/csu/../csu/libc-start.c:308:16
    #7 0x41c65d in _start (/programs/tcpreplay/asan/usr/local/bin/tcpreplay+0x41c65d)

0x6160000002ce is located 4 bytes to the right of 586-byte region [0x616000000080,0x6160000002ca)
allocated by thread T0 here:
    #0 0x4966cd in malloc (/programs/tcpreplay/asan/usr/local/bin/tcpreplay+0x4966cd)
    #1 0x4da815 in _our_safe_malloc /programs/tcpreplay/tcpreplay-4.3.3/src/common/utils.c:50:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /programs/tcpreplay/tcpreplay-4.3.3/src/send_packets.c:276:18 in fast_edit_packet
Shadow bytes around the buggy address:
  0x0c2c7fff8000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c7fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c7fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2c7fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2c7fff8050: 00 00 00 00 00 00 00 00 00[02]fa fa fa fa fa fa
  0x0c2c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c7fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==126819==ABORTING

To Reproduce
Steps to reproduce the behavior:

1. install tcpreplay 4.3.3
2. run tcpreplay as:
   tcpreplay -i eth0 -tK --loop 2 --unique-ip [pco_file]

Expected behavior
refuse abnormal input and exit, without throwing bug information

System

• OS: Ubuntu_20.04.1 x86_64
• Tcpreplay Version 4.3.3
  tcpreplay -V

    tcpreplay version: 4.3.3 (build git:v4.3.3)
    Copyright 2013-2018 by Fred Klassen <tcpreplay at appneta dot com> - AppNeta
    Copyright 2000-2012 by Aaron Turner <aturner at synfin dot net>
    The entire Tcpreplay Suite is licensed under the GPLv3
    Cache file supported: 04
    Not compiled with libdnet.
    Compiled against libpcap: 1.9.1
    64 bit packet counters: enabled
    Verbose printing via tcpdump: disabled
    Packet editing: disabled
    Fragroute engine: disabled
    Injection method: PF_PACKET send()
    Not compiled with netma

Additional context
tcpreplay_crash_2.zip

[fklassen]

Fixed in PR #640. This leverages safety checks added in #617