From a1750f5f09737b0c9fb7e63b551e8d46607b8cf8 Mon Sep 17 00:00:00 2001 From: Louis Date: Fri, 1 Dec 2023 09:40:10 +0100 Subject: [PATCH] decoder: ipfix have max size (#237) --- decoders/netflow/netflow.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/decoders/netflow/netflow.go b/decoders/netflow/netflow.go index e6451f0c..8c083610 100644 --- a/decoders/netflow/netflow.go +++ b/decoders/netflow/netflow.go @@ -283,12 +283,15 @@ func DecodeDataSet(version uint16, payload *bytes.Buffer, listFields []Field) ([ } func DecodeMessageCommon(payload *bytes.Buffer, templates NetFlowTemplateSystem, obsDomainId uint32, size, version uint16) (flowSets []interface{}, err error) { - for i := 0; ((i < int(size) && version == 9) || version == 10) && payload.Len() > 0; i++ { + var read int + startSize := payload.Len() + for i := 0; ((i < int(size) && version == 9) || (uint16(read) < size && version == 10)) && payload.Len() > 0; i++ { if flowSet, err := DecodeMessageCommonFlowSet(payload, templates, obsDomainId, version); err != nil { return flowSets, err } else { flowSets = append(flowSets, flowSet) } + read = startSize - payload.Len() } return flowSets, err } @@ -476,7 +479,7 @@ func DecodeMessageIPFIX(payload *bytes.Buffer, templates NetFlowTemplateSystem, /*size = packetIPFIX.Length packetIPFIX.Version = version obsDomainId = packetIPFIX.ObservationDomainId*/ - flowSets, err := DecodeMessageCommon(payload, templates, packetIPFIX.ObservationDomainId, packetIPFIX.Length, 10) + flowSets, err := DecodeMessageCommon(payload, templates, packetIPFIX.ObservationDomainId, packetIPFIX.Length-16, 10) packetIPFIX.FlowSets = flowSets if err != nil { return &DecoderError{"IPFIX", err}