new file mode 100644
@@ -0,0 +1,520 @@
+From d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9 Mon Sep 17 00:00:00 2001
+From: Denis Ovsienko <denis@ovsienko.info>
+Date: Thu, 30 Jul 2026 13:33:55 +0100
+Subject: [PATCH] CVE-2026-31912: Mind the program bounds in pcap_offline_filter().
+
+The current revision of pcapint_filter_with_aux_data() does not know the
+number of instructions in the filter program, it assumes the program
+counter always remains within the bounds of the provided filter program
+and always reaches a return instruction. This holds for programs that
+have been generated or validated by libpcap.
+
+However, this does not necessarily hold for programs that come from an
+external source via pcap_offline_filter() or [deprecated] bpf_filter()
+and have not been explicitly validated. If the interpreter executes
+such a program and advances the program counter beyond the last
+instruction, it will be interpreting memory space after the filter
+program as BPF instructions, which in the current implementation will
+eventually cause either abort() (another commit addresses that) or
+SIGSEGV.
+
+To fix the latter problem, in pcapint_filter_with_aux_data() add a
+parameter for the number of instructions in the program and reject the
+packet as soon as (or just before) the program counter goes out of
+bounds. Update all incoming code paths to specify the length; also in
+pcap_offline_filter(3PCAP) make it clear the function now requires the
+'bf_len' member to be set correctly and uses it.
+
+(backported from commit d1209988c74dd9330659898d3b676ee6bbe1c551)
+
+(cherry picked from commit d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9)
+
+Upstream-Status: Backport [https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9]
+CVE: CVE-2026-31912
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+diff --git a/bpf_filter.c b/bpf_filter.c
+index fa82d1d0..dec336ea 100644
+--- a/bpf_filter.c
++++ b/bpf_filter.c
+@@ -72,6 +72,24 @@ enum {
+ BPF_S_ANC_VLAN_TAG_PRESENT,
+ };
+
++/*
++ * Kernel BPF implementations tend to define BPF_MAXINSNS to 512 or 4096, the
++ * userland interpreter in libpcap is meant to support much longer filter
++ * programs. In the latter case it is important that BPF_MAXINSNS does not
++ * interfere with the safety checks in the validator and the interpreter:
++ * (BPF_MAXINSNS + UINT8_MAX) * sizeof(struct bpf_insn) < UINT32_MAX
++ * It makes the most sense to be able to interpret as many instructions as
++ * pcap_compile() can produce, without optimization, for a valid filter
++ * expression before it consumes as much memory as the current definitions of
++ * NCHUNKS and CHUNKSIZE() allow. For some expressions this can be almost
++ * 1.53 million instructions on a 64-bit machine and twice as many on a 32-bit
++ * machine.
++ */
++#ifdef BPF_MAXINSNS
++#undef BPF_MAXINSNS
++#endif
++#define BPF_MAXINSNS 3060000U
++
+ /*
+ * Execute the filter program starting at pc on the packet p
+ * wirelen is the length of the original packet
+@@ -86,12 +104,14 @@ enum {
+ */
+ #if defined(SKF_AD_VLAN_TAG_PRESENT)
+ u_int
+-pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_char *p,
+- u_int wirelen, u_int buflen, const struct pcap_bpf_aux_data *aux_data)
++pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_int proglen,
++ const u_char *p, const u_int wirelen, const u_int buflen,
++ const struct pcap_bpf_aux_data *aux_data)
+ #else
+ u_int
+-pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_char *p,
+- u_int wirelen, u_int buflen, const struct pcap_bpf_aux_data *aux_data _U_)
++pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_int proglen,
++ const u_char *p, const u_int wirelen, const u_int buflen,
++ const struct pcap_bpf_aux_data *aux_data _U_)
+ #endif
+ {
+ register uint32_t A, X;
+@@ -101,13 +121,36 @@ pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_char *p,
+ if (pc == 0)
+ /*
+ * No filter means accept all.
++ * In this case the value of 'proglen' is irrelevant.
+ */
+ return (u_int)-1;
++ if (proglen < 1 || proglen > BPF_MAXINSNS)
++ return 0;
++
++ /*
++ * Require the current instruction pointer not to overflow for both the
++ * filter program (where the pointer will be dereferenced) and an
++ * immediately following margin (where it will be not). So long as the
++ * margin is large enough to represent the destination of any single
++ * conditional [forward] jump from within the filter program, a single
++ * guard prevents all filter program over-read attempts that result
++ * from the program running out of instructions before a BPF_RET or a
++ * conditional jump directing the interpreter beyond the program end.
++ * Unconditional jumps mean a larger problem space, which the BPF_JA
++ * case below addresses separately.
++ */
++ const struct bpf_insn *pcend = pc + proglen;
++ if (pcend + UINT8_MAX < pc)
++ return 0;
++
+ A = 0;
+ X = 0;
++ const struct bpf_insn *pc0 = pc;
+ --pc;
+ for (;;) {
+ ++pc;
++ if (pc >= pcend)
++ return 0;
+ switch (pc->code) {
+
+ default:
+@@ -243,6 +286,40 @@ DIAG_ON_DEFAULT_ONLY_SWITCH
+ continue;
+
+ case BPF_JMP|BPF_JA:
++ /*
++ * The pointer (pc) decrements and increments in units
++ * of sizeof(struct bpf_insn) == 8 bytes. The number
++ * of units is in the [INT32_MIN, INT32_MAX] interval,
++ * hence the result can point before the beginning or
++ * beyond the end of the filter program and can under-
++ * or overflow; also on 32-bit architectures it can
++ * under- or overflow more than once and can test
++ * negative for underflow, overflow and out-of-range
++ * conditions after under- or overflowing at least
++ * once.
++ *
++ * However, it has been verified above that the program
++ * length is sufficiently small and the pointer does
++ * not wrap within the bounds of the filter program, so
++ * there is a one-to-one correspondence between BPF
++ * program counter values [0, proglen) and all valid
++ * values of the pointer. In other words, after this
++ * unconditional jump the pointer arithmetic result
++ * will be valid iff BPF program counter value will be
++ * valid. For the latter problem the solution is
++ * almost the same as in the validator.
++ *
++ * The main difference is that here the current value
++ * of BPF program counter is not a 32-bit unsigned
++ * variable, but a ptrdiff_t expression, which is
++ * 64-bit signed on 64-bit architectures and 32-bit
++ * signed on 32-bit architectures. However, the cast
++ * to 32-bit unsigned is safe in both cases because:
++ * pc0 <= pc < pc0 + proglen, therefore:
++ * 0 <= pc - pc0 < proglen <= BPF_MAXINSNS < INT32_MAX
++ */
++ if ((bpf_u_int32)(pc - pc0) + 1 + pc->k >= proglen)
++ return 0;
+ /*
+ * XXX - we currently implement "ip6 protochain"
+ * with backward jumps, so sign-extend pc->k.
+@@ -396,10 +473,10 @@ DIAG_ON_DEFAULT_ONLY_SWITCH
+ }
+
+ u_int
+-pcap_filter(const struct bpf_insn *pc, const u_char *p, u_int wirelen,
+- u_int buflen)
++pcap_filter(const struct bpf_insn *pc, const u_int proglen, const u_char *p,
++ u_int wirelen, u_int buflen)
+ {
+- return pcap_filter_with_aux_data(pc, p, wirelen, buflen, NULL);
++ return pcap_filter_with_aux_data(pc, proglen, p, wirelen, buflen, NULL);
+ }
+
+ /*
+@@ -419,7 +496,7 @@ pcap_validate_filter(const struct bpf_insn *f, int len)
+ u_int i, from;
+ const struct bpf_insn *p;
+
+- if (len < 1)
++ if (len < 1 || (u_int)len > BPF_MAXINSNS || f + len < f)
+ return 0;
+
+ for (i = 0; i < (u_int)len; ++i) {
+@@ -485,33 +562,45 @@ pcap_validate_filter(const struct bpf_insn *f, int len)
+ case BPF_JMP:
+ /*
+ * Check that jumps are within the code block,
+- * and that unconditional branches don't go
+- * backwards as a result of an overflow.
++ * regardless of the direction. libpcap uses
++ * backward jumps to implement the "protochain"
++ * primitive. All offsets that mean a backward
++ * jump in libpcap (whether in-range or not) in
++ * kernel BPF implementations mean out-of-range
++ * or overflow forward jumps -- kernel
++ * implementations must reject that.
++ *
+ * Unconditional branches have a 32-bit offset,
+ * so they could overflow; we check to make
+ * sure they don't. Conditional branches have
+ * an 8-bit offset, and the from address is <=
+- * BPF_MAXINSNS, and we assume that BPF_MAXINSNS
++ * BPF_MAXINSNS, and we know that BPF_MAXINSNS
+ * is sufficiently small that adding 255 to it
+ * won't overflow.
+ *
+ * We know that len is <= BPF_MAXINSNS, and we
+- * assume that BPF_MAXINSNS is < the maximum size
++ * know that BPF_MAXINSNS is < the maximum value
+ * of a u_int, so that i + 1 doesn't overflow.
+- *
+- * For userland, we don't know that the from
+- * or len are <= BPF_MAXINSNS, but we know that
+- * from <= len, and, except on a 64-bit system,
+- * it's unlikely that len, if it truly reflects
+- * the size of the program we've been handed,
+- * will be anywhere near the maximum size of
+- * a u_int. We also don't check for backward
+- * branches, as we currently support them in
+- * userland for the protochain operation.
+ */
+ from = i + 1;
+ switch (BPF_OP(p->code)) {
+ case BPF_JA:
++ /*
++ * So long as both 'from' and bpf_insn.k are
++ * 32-bit unsigned, this check rejects any jump
++ * offset that points outside of the valid BPF
++ * address space of the filter program no
++ * matter whether signed interpretation of the
++ * offset is positive or negative.
++ *
++ * Note that this condition is necessary, but
++ * not sufficient to get correct results from
++ * respective pointer arithmetic in the process
++ * address space. Other necessary conditions
++ * are that BPF_MAXINSNS is correctly defined
++ * and enforced, and that the pointer does not
++ * overflow.
++ */
+ if (from + p->k >= (u_int)len)
+ return 0;
+ break;
+@@ -539,12 +628,14 @@ pcap_validate_filter(const struct bpf_insn *f, int len)
+
+ /*
+ * Exported because older versions of libpcap exported them.
++ * This function is deprecated and unsafe, use pcap_offline_filter() instead.
+ */
+ u_int
+ bpf_filter(const struct bpf_insn *pc, const u_char *p, u_int wirelen,
+ u_int buflen)
+ {
+- return pcap_filter(pc, p, wirelen, buflen);
++ // The actual length of the filter program is not known.
++ return pcap_filter(pc, BPF_MAXINSNS, p, wirelen, buflen);
+ }
+
+ int
+diff --git a/dlpisubs.c b/dlpisubs.c
+index 6815b0ec..790acf28 100644
+--- a/dlpisubs.c
++++ b/dlpisubs.c
+@@ -195,7 +195,8 @@ pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char *user,
+ bufp += caplen;
+ #endif
+ ++pd->stat.ps_recv;
+- if (pcap_filter(p->fcode.bf_insns, pk, origlen, caplen)) {
++ if (pcap_filter(p->fcode.bf_insns, p->fcode.bf_len,
++ pk, origlen, caplen)) {
+ #ifdef HAVE_SYS_BUFMOD_H
+ pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec;
+ pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec;
+diff --git a/pcap-bpf.c b/pcap-bpf.c
+index 2898e598..04b5620d 100644
+--- a/pcap-bpf.c
++++ b/pcap-bpf.c
+@@ -1255,7 +1255,8 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
+ #endif
+ */
+ if (pb->filtering_in_kernel ||
+- pcap_filter(p->fcode.bf_insns, datap, bhp->bh_datalen, caplen)) {
++ pcap_filter(p->fcode.bf_insns, p->fcode.bf_len,
++ datap, bhp->bh_datalen, caplen)) {
+ struct pcap_pkthdr pkthdr;
+ #ifdef BIOCSTSTAMP
+ struct bintime bt;
+diff --git a/pcap-bt-linux.c b/pcap-bt-linux.c
+index c7bfef1d..dcf3b575 100644
+--- a/pcap-bt-linux.c
++++ b/pcap-bt-linux.c
+@@ -394,7 +394,8 @@ bt_read_linux(pcap_t *handle, int max_packets _U_, pcap_handler callback, u_char
+ pkth.caplen+=sizeof(pcap_bluetooth_h4_header);
+ pkth.len = pkth.caplen;
+ if (handle->fcode.bf_insns == NULL ||
+- pcap_filter(handle->fcode.bf_insns, pktd, pkth.len, pkth.caplen)) {
++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len,
++ pktd, pkth.len, pkth.caplen)) {
+ callback(user, &pkth, pktd);
+ return 1;
+ }
+diff --git a/pcap-bt-monitor-linux.c b/pcap-bt-monitor-linux.c
+index 206e65b5..3f9d5b49 100644
+--- a/pcap-bt-monitor-linux.c
++++ b/pcap-bt-monitor-linux.c
+@@ -151,7 +151,8 @@ bt_monitor_read(pcap_t *handle, int max_packets _U_, pcap_handler callback, u_ch
+ bthdr->opcode = htons(hdr.opcode);
+
+ if (handle->fcode.bf_insns == NULL ||
+- pcap_filter(handle->fcode.bf_insns, pktd, pkth.len, pkth.caplen)) {
++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len,
++ pktd, pkth.len, pkth.caplen)) {
+ callback(user, &pkth, pktd);
+ return 1;
+ }
+diff --git a/pcap-dag.c b/pcap-dag.c
+index f261ead0..c3fe1dbd 100644
+--- a/pcap-dag.c
++++ b/pcap-dag.c
+@@ -668,8 +668,9 @@ dag_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
+ caplen = p->snapshot;
+
+ /* Run the packet filter if there is one. */
+- if ((p->fcode.bf_insns == NULL) || pcap_filter(p->fcode.bf_insns, dp, packet_len, caplen)) {
+-
++ if (p->fcode.bf_insns == NULL ||
++ pcap_filter(p->fcode.bf_insns, p->fcode.bf_len,
++ dp, packet_len, caplen)) {
+ /* convert between timestamp formats */
+ register unsigned long long ts;
+
+diff --git a/pcap-dbus.c b/pcap-dbus.c
+index 506f150f..760bb9ba 100644
+--- a/pcap-dbus.c
++++ b/pcap-dbus.c
+@@ -91,7 +91,8 @@ dbus_read(pcap_t *handle, int max_packets _U_, pcap_handler callback, u_char *us
+
+ gettimeofday(&pkth.ts, NULL);
+ if (handle->fcode.bf_insns == NULL ||
+- pcap_filter(handle->fcode.bf_insns, (u_char *)raw_msg, pkth.len, pkth.caplen)) {
++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len,
++ (u_char *)raw_msg, pkth.len, pkth.caplen)) {
+ handlep->packets_read++;
+ callback(user, &pkth, (u_char *)raw_msg);
+ count++;
+diff --git a/pcap-dpdk.c b/pcap-dpdk.c
+index 025a6748..cc31d2f2 100644
+--- a/pcap-dpdk.c
++++ b/pcap-dpdk.c
+@@ -407,7 +407,9 @@ static int pcap_dpdk_dispatch(pcap_t *p, int max_cnt, pcap_handler cb, u_char *c
+
+ }
+ if (bp){
+- if (p->fcode.bf_insns==NULL || pcap_filter(p->fcode.bf_insns, bp, pcap_header.len, pcap_header.caplen)){
++ if (p->fcode.bf_insns==NULL ||
++ pcap_filter(p->fcode.bf_insns, p->fcode.bf_len,
++ bp, pcap_header.len, pcap_header.caplen)){
+ cb(cb_arg, &pcap_header, bp);
+ }else{
+ pd->bpf_drop++;
+diff --git a/pcap-int.h b/pcap-int.h
+index 894e74af..11ca3c56 100644
+--- a/pcap-int.h
++++ b/pcap-int.h
+@@ -619,13 +619,15 @@ struct pcap_bpf_aux_data {
+ * Filtering routine that takes the auxiliary data as an additional
+ * argument.
+ */
+-u_int pcap_filter_with_aux_data(const struct bpf_insn *,
+- const u_char *, u_int, u_int, const struct pcap_bpf_aux_data *);
++u_int pcap_filter_with_aux_data(const struct bpf_insn *, const u_int,
++ const u_char *, const u_int, const u_int,
++ const struct pcap_bpf_aux_data *);
+
+ /*
+ * Filtering routine that doesn't.
+ */
+-u_int pcap_filter(const struct bpf_insn *, const u_char *, u_int, u_int);
++u_int pcap_filter(const struct bpf_insn *, const u_int, const u_char *,
++ u_int, u_int);
+
+ /*
+ * Routine to validate a BPF program.
+diff --git a/pcap-linux.c b/pcap-linux.c
+index 13bd8529..b2b2ca70 100644
+--- a/pcap-linux.c
++++ b/pcap-linux.c
+@@ -3993,6 +3993,7 @@ static int pcap_handle_packet_mmap(
+ aux_data.vlan_tag = tp_vlan_tci & 0x0fff;
+
+ if (pcap_filter_with_aux_data(handle->fcode.bf_insns,
++ handle->fcode.bf_len,
+ bp,
+ tp_len,
+ snaplen,
+diff --git a/pcap-netfilter-linux.c b/pcap-netfilter-linux.c
+index 2eb0fc8c..5b5f5c18 100644
+--- a/pcap-netfilter-linux.c
++++ b/pcap-netfilter-linux.c
+@@ -259,8 +259,8 @@ netfilter_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_c
+
+ gettimeofday(&pkth.ts, NULL);
+ if (handle->fcode.bf_insns == NULL ||
+- pcap_filter(handle->fcode.bf_insns, payload, pkth.len, pkth.caplen))
+- {
++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len,
++ payload, pkth.len, pkth.caplen)) {
+ handlep->packets_read++;
+ callback(user, &pkth, payload);
+ count++;
+diff --git a/pcap-netmap.c b/pcap-netmap.c
+index 27d36e5b..bcfd6e93 100644
+--- a/pcap-netmap.c
++++ b/pcap-netmap.c
+@@ -81,7 +81,8 @@ pcap_netmap_filter(u_char *arg, struct pcap_pkthdr *h, const u_char *buf)
+ const struct bpf_insn *pc = p->fcode.bf_insns;
+
+ ++pn->rx_pkts;
+- if (pc == NULL || pcap_filter(pc, buf, h->len, h->caplen))
++ if (pc == NULL ||
++ pcap_filter(pc, p->fcode.bf_len, buf, h->len, h->caplen))
+ pn->cb(pn->cb_arg, h, buf);
+ }
+
+diff --git a/pcap-npf.c b/pcap-npf.c
+index 99b5981e..a4364353 100644
+--- a/pcap-npf.c
++++ b/pcap-npf.c
+@@ -682,7 +682,8 @@ pcap_read_npf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
+ */
+ if (pw->filtering_in_kernel ||
+ p->fcode.bf_insns == NULL ||
+- pcap_filter(p->fcode.bf_insns, datap, bhp->bh_datalen, caplen)) {
++ pcap_filter(p->fcode.bf_insns, p->fcode.bf_len,
++ datap, bhp->bh_datalen, caplen)) {
+ #ifdef ENABLE_REMOTE
+ switch (p->rmt_samp.method) {
+
+diff --git a/pcap-rdmasniff.c b/pcap-rdmasniff.c
+index d63ca898..c8763b33 100644
+--- a/pcap-rdmasniff.c
++++ b/pcap-rdmasniff.c
+@@ -172,7 +172,8 @@ rdmasniff_read(pcap_t *handle, int max_packets, pcap_handler callback, u_char *u
+ pktd = (u_char *) handle->buffer + wc.wr_id * RDMASNIFF_RECEIVE_SIZE;
+
+ if (handle->fcode.bf_insns == NULL ||
+- pcap_filter(handle->fcode.bf_insns, pktd, pkth.len, pkth.caplen)) {
++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len,
++ pktd, pkth.len, pkth.caplen)) {
+ callback(user, &pkth, pktd);
+ ++priv->packets_recv;
+ ++count;
+diff --git a/pcap-snf.c b/pcap-snf.c
+index fe9cc9c8..16ce9c8e 100644
+--- a/pcap-snf.c
++++ b/pcap-snf.c
+@@ -192,7 +192,8 @@ snf_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
+ caplen = p->snapshot;
+
+ if ((p->fcode.bf_insns == NULL) ||
+- pcap_filter(p->fcode.bf_insns, req.pkt_addr, req.length, caplen)) {
++ pcap_filter(p->fcode.bf_insns, p->fcode.bf_len,
++ req.pkt_addr, req.length, caplen)) {
+ hdr.ts = snf_timestamp_to_timeval(req.timestamp, p->opt.tstamp_precision);
+ hdr.caplen = caplen;
+ hdr.len = req.length;
+diff --git a/pcap-usb-linux.c b/pcap-usb-linux.c
+index 726e4a8a..44b2bf30 100644
+--- a/pcap-usb-linux.c
++++ b/pcap-usb-linux.c
+@@ -735,8 +735,8 @@ usb_read_linux_bin(pcap_t *handle, int max_packets _U_, pcap_handler callback, u
+ pkth.ts.tv_usec = info.hdr->ts_usec;
+
+ if (handle->fcode.bf_insns == NULL ||
+- pcap_filter(handle->fcode.bf_insns, handle->buffer,
+- pkth.len, pkth.caplen)) {
++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len,
++ handle->buffer, pkth.len, pkth.caplen)) {
+ handlep->packets_read++;
+ callback(user, &pkth, handle->buffer);
+ return 1;
+@@ -904,8 +904,8 @@ usb_read_linux_mmap(pcap_t *handle, int max_packets, pcap_handler callback, u_ch
+ pkth.ts.tv_usec = hdr->ts_usec;
+
+ if (handle->fcode.bf_insns == NULL ||
+- pcap_filter(handle->fcode.bf_insns, (u_char*) hdr,
+- pkth.len, pkth.caplen)) {
++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len,
++ (u_char*) hdr, pkth.len, pkth.caplen)) {
+ handlep->packets_read++;
+ callback(user, &pkth, (u_char*) hdr);
+ packets++;
+diff --git a/pcap.c b/pcap.c
+index ef1bbb71..9ee83f98 100644
+--- a/pcap.c
++++ b/pcap.c
+@@ -4179,7 +4179,7 @@ pcap_offline_filter(const struct bpf_program *fp, const struct pcap_pkthdr *h,
+ const struct bpf_insn *fcode = fp->bf_insns;
+
+ if (fcode != NULL)
+- return (pcap_filter(fcode, pkt, h->len, h->caplen));
++ return (pcap_filter(fcode, fp->bf_len, pkt, h->len, h->caplen));
+ else
+ return (0);
+ }
+diff --git a/savefile.c b/savefile.c
+index db8a3aa0..e9708b23 100644
+--- a/savefile.c
++++ b/savefile.c
+@@ -687,7 +687,8 @@ pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
+ * and, if it passes, process it.
+ */
+ if ((fcode = p->fcode.bf_insns) == NULL ||
+- pcap_filter(fcode, data, h.len, h.caplen)) {
++ pcap_filter(fcode, p->fcode.bf_len,
++ data, h.len, h.caplen)) {
+ (*callback)(user, &h, data);
+ n++; /* count the packet */
+ if (n >= cnt)
@@ -18,6 +18,7 @@ SRC_URI = "https://www.tcpdump.org/release/${BP}.tar.gz \
file://CVE-2025-11961-02.patch \
file://CVE-2025-11964.patch \
file://01-CVE-2026-0799.patch \
+ file://02-CVE-2026-31912.patch \
"
SRC_URI[sha256sum] = "ed19a0383fad72e3ad435fd239d7cd80d64916b87269550159d20e47160ebe5f"
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31912 Upstream-commit: https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9 Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> --- .../libpcap/libpcap/02-CVE-2026-31912.patch | 520 ++++++++++++++++++ .../libpcap/libpcap_1.10.4.bb | 1 + 2 files changed, 521 insertions(+) create mode 100644 meta/recipes-connectivity/libpcap/libpcap/02-CVE-2026-31912.patch