Merge pull request #1830 from monitoring-plugins/fix_1829

check_http: Fix memory reallocation error in chunk decoding logic

1 files changed, 7 insertions, 6 deletions

diff --git a/plugins/check_http.c b/plugins/check_http.c
index a9c22389..5fa310f5 100644
--- a/plugins/check_http.c
+++ b/plugins/check_http.c
@@ -1399,7 +1399,6 @@ char *unchunk_content(const char *content) {
   char *endptr;
   long length_of_chunk = 0;
   size_t overall_size = 0;
-  char *result_ptr;
 
   while (true) {
     size_of_chunk = strtol(pointer, &endptr, 16);
@@ -1439,26 +1438,28 @@ char *unchunk_content(const char *content) {
     overall_size += length_of_chunk;
 
     if (result == NULL) {
-      result = (char *)calloc(length_of_chunk, sizeof(char));
+      // Size of the chunk plus the ending NULL byte
+      result = (char *)malloc(length_of_chunk +1);
       if (result == NULL) {
         if (verbose) {
           printf("Failed to allocate memory for unchunked body\n");
         }
         return NULL;
       }
-      result_ptr = result;
     } else {
-      void *tmp = realloc(result, overall_size);
+      // Enlarge memory to the new size plus the ending NULL byte
+      void *tmp = realloc(result, overall_size +1);
       if (tmp == NULL) {
         if (verbose) {
           printf("Failed to allocate memory for unchunked body\n");
         }
         return NULL;
+      } else {
+        result = tmp;
       }
     }
 
-    memcpy(result_ptr, start_of_chunk, size_of_chunk);
-    result_ptr = result_ptr + size_of_chunk;
+    memcpy(result + (overall_size - size_of_chunk), start_of_chunk, size_of_chunk);
   }
 
   result[overall_size] = '\0';