The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.
{ "vanir_signatures": [ { "id": "CVE-2020-8037-625654ac", "target": { "function": "ppp_hdlc", "file": "print-ppp.c" }, "digest": { "length": 1251.0, "function_hash": "114072365358220823879709176952693676320" }, "signature_type": "Function", "deprecated": false, "source": "https://github.com/the-tcpdump-group/tcpdump/commit/32027e199368dad9508965aae8cd8de5b6ab5231", "signature_version": "v1" }, { "id": "CVE-2020-8037-df93f99f", "target": { "file": "print-ppp.c" }, "digest": { "line_hashes": [ "75602926860762894768813751569532021359", "9867738560598064159077092336868710730", "226286868117138916932261892023417786878", "312535365908525278831835037643938069206", "193708830256193212648148804585932547330", "225582233472056077528484568223799068742", "87512221018872648189638407990642100373", "331997209997900974668790162158431339155", "32254091627956064590784894660703272575", "275556175249599490980814440375788132190", "79058067046007865613622272898805451482", "96770968572884396529904239864250777959", "15054595184741052885796942294073694432", "169938687647837023712455514535228888440", "179516277381903108913256904174120081207", "188861693945644257165746229702332158795", "241755533398317547277580406153182923367", "277299685682914552613762330927893646226", "43450640239716668424840137206990379970", "169909079340584079484773553150578196492" ], "threshold": 0.9 }, "signature_type": "Line", "deprecated": false, "source": "https://github.com/the-tcpdump-group/tcpdump/commit/32027e199368dad9508965aae8cd8de5b6ab5231", "signature_version": "v1" } ] }