snmp plugin: Ensure that index is within bounds.

[collectd.git] / src / snmp.c

diff --git a/src/snmp.c b/src/snmp.c
index 3bfec47..ffeface 100644 (file)
--- a/src/snmp.c
+++ b/src/snmp.c
@@ -1357,12 +1357,17 @@ static int csnmp_read_table(host_definition_t *host, data_definition_t *data) {
     if (oid_list_todo_num == 0) {
       /* The request is still empty - so we are finished */
       DEBUG("snmp plugin: all variables have left their subtree");
+      snmp_free_pdu(req);
       status = 0;
       break;
     }
 
     res = NULL;
     status = snmp_sess_synch_response(host->sess_handle, req, &res);
+
+    /* snmp_sess_synch_response always frees our req PDU */
+    req = NULL;
+
     if ((status != STAT_SUCCESS) || (res == NULL)) {
       char *errstr = NULL;
 
@@ -1376,8 +1381,6 @@ static int csnmp_read_table(host_definition_t *host, data_definition_t *data) {
         snmp_free_pdu(res);
       res = NULL;
 
-      /* snmp_synch_response already freed our PDU */
-      req = NULL;
       sfree(errstr);
       csnmp_host_close_session(host);
 
@@ -1400,8 +1403,12 @@ static int csnmp_read_table(host_definition_t *host, data_definition_t *data) {
     for (vb = res->variables, i = 0; (vb != NULL);
          vb = vb->next_variable, i++) {
       /* Calculate value index from todo list */
-      while ((i < oid_list_len) && !oid_list_todo[i])
+      while ((i < oid_list_len) && !oid_list_todo[i]) {
         i++;
+      }
+      if (i >= oid_list_len) {
+        break;
+      }
 
       /* An instance is configured and the res variable we process is the
        * instance value (last index) */
@@ -1492,10 +1499,6 @@ static int csnmp_read_table(host_definition_t *host, data_definition_t *data) {
     snmp_free_pdu(res);
   res = NULL;
 
-  if (req != NULL)
-    snmp_free_pdu(req);
-  req = NULL;
-
   if (status == 0)
     csnmp_dispatch_table(host, data, instance_list_head, value_list_head);