lmp_print in tcpdump lacks certain boundary checks

An attacker can craft a malformed LMP packet with truncated sub-objects that cause `lmp_print_data_link_subobjs()` to read beyond the captured packet data [ref_id=1]. The function reads sub-object fields (e.g., switching type, encoding type, wavelength, bandwidth) without first checking that the required bytes are present in the snapshot [ref_id=1]. When the packet is shorter than expected, the missing bounds checks lead to an out-of-bounds read, which can crash tcpdump or leak memory [ref_id=1]. The attacker only needs to send a single crafted UDP packet to a target running tcpdump and capturing LMP traffic.

The vulnerability is in the `lmp_print_data_link_subobjs()` function in `print-lmp.c` [ref_id=1]. The function iterates over sub-objects in an LMP Data Link object but lacks bounds checks before reading fields such as sub-object type, length, switching type, encoding type, and bandwidth values [ref_id=1]. The patch adds `ND_TCHECK_*` macros at multiple read points to ensure the captured packet data is long enough before extraction [ref_id=1].

The patch adds `ND_TCHECK_16BITS`, `ND_TCHECK_8BITS`, and `ND_TCHECK_32BITS` calls before each field read in `lmp_print_data_link_subobjs()` [ref_id=1]. These macros verify that the specified number of bytes are available within the captured packet boundary before the data is extracted [ref_id=1]. If the check fails, control jumps to the `trunc` label, which now prints `[|LMP]` instead of the misleading `"packet exceeded snapshot"` message [ref_id=1]. This prevents out-of-bounds reads from truncated packets.