decoder: ipfix have max size (#237)

netsampler · Dec 1, 2023 · a1750f5 · a1750f5
1 parent 7624684
commit a1750f5
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/decoders/netflow/netflow.go b/decoders/netflow/netflow.go
@@ -283,12 +283,15 @@ func DecodeDataSet(version uint16, payload *bytes.Buffer, listFields []Field) ([
 }
 
 func DecodeMessageCommon(payload *bytes.Buffer, templates NetFlowTemplateSystem, obsDomainId uint32, size, version uint16) (flowSets []interface{}, err error) {
-	for i := 0; ((i < int(size) && version == 9) || version == 10) && payload.Len() > 0; i++ {
+	var read int
+	startSize := payload.Len()
+	for i := 0; ((i < int(size) && version == 9) || (uint16(read) < size && version == 10)) && payload.Len() > 0; i++ {
 		if flowSet, err := DecodeMessageCommonFlowSet(payload, templates, obsDomainId, version); err != nil {
 			return flowSets, err
 		} else {
 			flowSets = append(flowSets, flowSet)
 		}
+		read = startSize - payload.Len()
 	}
 	return flowSets, err
 }
@@ -476,7 +479,7 @@ func DecodeMessageIPFIX(payload *bytes.Buffer, templates NetFlowTemplateSystem,
 	/*size = packetIPFIX.Length
 	packetIPFIX.Version = version
 	obsDomainId = packetIPFIX.ObservationDomainId*/
-	flowSets, err := DecodeMessageCommon(payload, templates, packetIPFIX.ObservationDomainId, packetIPFIX.Length, 10)
+	flowSets, err := DecodeMessageCommon(payload, templates, packetIPFIX.ObservationDomainId, packetIPFIX.Length-16, 10)
 	packetIPFIX.FlowSets = flowSets
 	if err != nil {
 		return &DecoderError{"IPFIX", err}