CVE-2023-27786

An attacker can trigger a NULL pointer dereference by passing an empty MAC string (`""`) via the `-e` option to `tcpprep` when operating in Source MAC split mode [ref_id=1]. The program reads a provided pcap file (e.g., `test.pcap`) and processes packets, but when `macinstring()` receives an empty string, it attempts to call `strlen()` on a pointer that leads to a read at address zero, causing a segmentation fault [ref_id=1]. No authentication or special network access is required — the attacker only needs to invoke the binary with the crafted argument.

The vulnerability is in the `macinstring()` function in `mac.c` at line 120 [ref_id=1]. The function is called from `process_raw_packets()` in `tcpprep.c` at line 450, which is invoked by `main()` at line 144 [ref_id=1].

No patch is provided in the bundle. The advisory [ref_id=1] identifies the root cause as a missing check for an empty MAC string in `macinstring()` at `mac.c:120`. The fix would require validating that the input string is non-empty before proceeding with `strlen()` and subsequent processing, returning an error or handling the empty case gracefully instead of dereferencing a NULL pointer.

Run the command: `$ ./tcpprep -e "" --pcap=./test.pcap --cachefile=/dev/null` using a pcap file from the tcpreplay codebase (e.g., `test/test.pcap`) [ref_id=1]. The program will crash with a segmentation fault due to a NULL pointer dereference in `macinstring()` at `mac.c:120` [ref_id=1].