Tcpreplay prior to 4.3.1 has a heap-based buffer over-read in get_l2len in common/get.c.
broadcom tcpreplay