Merge pull request #1811 from rubenk/backport-cve-2016-6254-to-4.10

network plugin: Fix heap overflow in parse_packet().

diff --git a/src/network.c b/src/network.c
index f379a5c..c2d20be 100644 (file)
--- a/src/network.c
+++ b/src/network.c
@@ -1429,6 +1429,7 @@ static int parse_packet (sockent_t *se, /* {{{ */
                                printed_ignore_warning = 1;
                        }
                        buffer = ((char *) buffer) + pkg_length;
+                       buffer_size -= (size_t) pkg_length;
                        continue;
                }
 #endif /* HAVE_LIBGCRYPT */
@@ -1456,6 +1457,7 @@ static int parse_packet (sockent_t *se, /* {{{ */
                                printed_ignore_warning = 1;
                        }
                        buffer = ((char *) buffer) + pkg_length;
+                       buffer_size -= (size_t) pkg_length;
                        continue;
                }
 #endif /* HAVE_LIBGCRYPT */
@@ -1578,6 +1580,7 @@ static int parse_packet (sockent_t *se, /* {{{ */
                        DEBUG ("network plugin: parse_packet: Unknown part"
                                        " type: 0x%04hx", pkg_type);
                        buffer = ((char *) buffer) + pkg_length;
+                       buffer_size -= (size_t) pkg_length;
                }
        } /* while (buffer_size > sizeof (part_header_t)) */