From d4c3b96ae3ef7c27b5a7b9f1d58daae7f40acf87 Mon Sep 17 00:00:00 2001
From: ekleezg <mochaccino.00.00@gmail.com>
Date: Tue, 20 May 2025 14:10:34 +0900
Subject: Insert a remaining buffer length check before dereferencing the
 pointer

---
 addons/snmp/nxd_snmp.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/addons/snmp/nxd_snmp.c b/addons/snmp/nxd_snmp.c
index 6fac9bbf..9b555c8c 100644
--- a/addons/snmp/nxd_snmp.c
+++ b/addons/snmp/nxd_snmp.c
@@ -18587,6 +18587,20 @@ INT         buffer_length;
     buffer_length -= (INT)length;
 
     /**** Now we are positioned in front of the security parameters field.  ****/
+    if (buffer_length < 2)
+    {
+        /* Increment the invalid packet error counter.  */
+        agent_ptr -> nx_snmp_agent_invalid_packets++;
+
+        /* Increment the internal error counter.  */
+        agent_ptr -> nx_snmp_agent_internal_errors++;
+
+        /* Release the packet.  */
+        nx_packet_release(packet_ptr);
+
+        /* Return to caller.  */
+        return;
+    }
 
     /* Determine if there are security parameters.  */
     if ((buffer_ptr[0] == NX_SNMP_ANS1_OCTET_STRING) && (buffer_ptr[1]))
-- 
cgit v1.3.1