Tcpreplay prior to 4.3.1 has a heap-based buffer over-read in packet2tree in tree.c.
broadcom tcpreplay